MongoDB Documentation, Release 3.0.4 Security Release Notes (page 431) Security vulnerability for password. Changed in version 2.4. In 2.4, only users with the userAdmin role have access to the system.users collection. In version 2.2 and earlier, the read-write users of a database all have access to the system.users collection, which contains the user names and user password hashes. 87 If a user has the same password for multiple databases, the hash will be the same. A malicious user could exploit this to gain access on a second database using a different user’s credentials. As a result, always use unique username and password combinations for each database. Thanks to Will Urbanski, from Dell SecureWorks, for identifying this issue. This documents provides a list of security measures that you should implement to protect your MongoDB installation. Enable MongoDB authentication and specify the authentication mechanism. You can use the MongoDB authentica- tion mechanism or an existing external framework. Authentication requires that all clients and servers provide valid credentials before they can connect to the system. In clustered deployments, enable authentication for each MongoDB server. See Authentication (page 320), Enable Client Access Control (page 357), and Enable Authentication in a Sharded Cluster (page 358). 87 Read-only users do not have access to the system.users collection. 431 6.5. Security Checklist 6.5 Security Checklist 6.5.1 Require Authentication Password Hashing Insecurity Access to system.users Collection Security Release Notes 6.4.3 Security Release Notes Alerts Table 6.1 – continued from previous page atype param result applicationMessage (page 422) { msg: <custom message string> } See logApplicationMessage . 0 - Success