Port 27017 – MongoDB

TCP

Port 27017 is the default MongoDB port. MongoDB has a history of security incidents from exposed instances – in 2017 over 28,000 publicly accessible MongoDB databases were held ransom. MongoDB should bind to 127.0.0.1 and use authentication. MongoDB Atlas handles this automatically.

Port Number

27017

Protocol

TCP

Service

MongoDB Database

Range

IANA Registered (1024–49151)

Description

MongoDB uses port 27017 for its wire protocol. MongoDB replica sets use ports 27017-27019 by convention. MongoDB changed its default behavior in version 3.6 to bind to localhost only, but many older or misconfigured instances remain exposed. Always enable authentication even for internal instances.

Security risks

1No-auth default (pre-3.6): older MongoDB versions allowed unauthenticated access. The 2017 MongoDB Apocalypse ransomed 28,000+ databases. Enable authorization in mongod.conf: security.authorization: enabled.
2SSRF to localhost: even when MongoDB binds to 127.0.0.1, web application SSRF vulnerabilities can reach it. An SSRF to mongodb://127.0.0.1:27017 with crafted queries exfiltrates data. Use authentication even on localhost.
3JavaScript injection: MongoDB's $where operator and mapReduce execute JavaScript. Unsanitized user input in queries enables NoSQL injection equivalent to SQLi. Avoid $where entirely; use aggregation pipeline instead.
4Replica set exposure: mongod replica set members communicate on ports 27017-27019. If any member is internet-accessible without auth, attackers can join as a hidden replica and receive all data changes via the oplog.

Firewall guidance

Bind mongod to 127.0.0.1 or a private interface (net.bindIp in mongod.conf). Never allow inbound 27017 from 0.0.0.0/0. For Atlas, connections come from a fixed set of IPs – whitelist only your application server IPs. For self-hosted, use VPC security groups restricting to app servers. Developers should use SSH tunneling or mongosh over authenticated TLS.

Diagnosis commands

Test connectivity and auth status

shell

mongosh --host host --port 27017 --eval 'db.runCommand({connectionStatus:1})'

Remote MongoDB detection and version fingerprinting

shell

nmap -sV -p 27017 --script mongodb-info target

Check which auth mechanisms are enabled

shell

mongosh --eval 'db.adminCommand({getParameter:1, authenticationMechanisms:1})'

Usage examples

Port 27017 – MongoDB

shell

mongosh --host localhost --port 27017
mongosh 'mongodb://user:pass@localhost:27017/db'
mongodump --host localhost --port 27017

Common services on this port

MongoDB CommunityMongoDB EnterpriseMongoDB AtlasAmazon DocumentDBAzure Cosmos DB (Mongo API)Percona Server for MongoDB

Related ports

27018

MongoDB shard server

27019

MongoDB config server

3306

MySQL (similar exposure risk)

History

MongoDB was created by 10gen (now MongoDB Inc) in 2009. Port 27017 was chosen arbitrarily. The name comes from 'humongous'. Version 3.6 (2017) changed the default bind to localhost after the 2017 mass-ransom incident. Version 6.0 (2022) added queryable encryption.

FAQ

Is MongoDB still insecure by default?

Since version 3.6 (2017), MongoDB binds to localhost only and enables authentication by default in the official Docker image. But self-compiled or older package installs may still default to open. Always verify: mongosh --eval 'db.adminCommand({getParameter:1,"authenticationMechanisms":1})'.

MongoDB Atlas vs self-hosted security?

Atlas enforces authentication, encryption at rest, TLS in transit, and IP allowlisting by default. Self-hosted requires you to configure all of these manually. For teams without dedicated DBAs, Atlas eliminates the most common MongoDB security mistakes.