# MongoDB Without Authentication

> Detects MongoDB connections without authentication credentials or configurations that disable authorization.

- Skill: `zakirkun/mongodb-without-authentication` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/mongodb-without-authentication`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/mongodb-without-authentication/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/mongodb-without-authentication

---


# MongoDB Without Authentication

## Overview
MongoDB instances without authentication allow any client that reaches the port to read, write, or delete all databases. This has led to numerous mass data breaches. Default MongoDB installations prior to 3.0 had no authentication.

## Remediation
- Enable `--auth` flag or set `security.authorization: enabled` in `mongod.conf`
- Create admin user with strong password before exposing MongoDB
- Bind to localhost or use VPC/firewall rules
- Use TLS for connections