[cursor]

Bug and impact

check_mongodb_noauth treated a successful isMaster/hello wire-protocol reply as confirmed CRITICAL unauthenticated MongoDB access.

MongoDB always answers hello/isMaster without credentials, including when --auth is enabled. Fusion maps every service_probe_result finding to source=probe + high reliability, and the gate pins those as un-droppable. A false CRITICAL therefore lands in the report, HackerOne export, and executive summary.

Redis already fail-closes on NOAUTH. MongoDB did not distinguish handshake from data access.

Trigger: --probe / --full (or any GUI scan with probes) against a host with 27017 open:

• Any MongoDB with authorization enabled still returns ismaster / maxBsonObjectSize / localTime
• The scan reports MongoDB — Unauthenticated Access (CRITICAL) even though listDatabases would return Unauthorized

Root cause

Identity was used as authorization. isMaster OP_QUERY succeeding means “this is MongoDB”, not “unauthenticated data access”.

Fix

• Keep isMaster OP_QUERY as the identity check.
• Confirm CRITICAL only when unauthenticated listDatabases (OP_MSG, required on MongoDB 6+) returns the BSON databases array.
• Fail closed on Unauthorized / requires authentication, and do not substring-match databases (the auth-error errmsg contains listDatabases).

Validation

python3 -m pytest test_probers.py test_hardening.py -q — 64 passed.