Skip to content

Access Control: MongoDB Authentication Disabled

Identifier: mongo_no_auth

Scanner Support

GraphQL Scanner REST Scanner WebApp Scanner ASM Scanner Automated Pentest

Description

MongoDB instances without authentication can allow unauthenticated users to read or modify database contents.

How we test: We attempt to connect and run a benign MongoDB command without credentials and report the issue when the server accepts the unauthenticated request.

Configuration

Example

Example configuration:

---
security_tests:
  mongo_no_auth:
    skip: false

Reference

skip

Type: boolean

Skip the test if true.