TCP Port 27017 – MongoDB
Port 27017 is the default port for MongoDB, an open-source document-oriented database first released in 2009 and developed by MongoDB Inc. (formerly 10gen). MongoDB stores data as flexible JSON-like documents rather than the structured rows and columns of traditional relational databases, which made it well-suited to the rapid-iteration development style of the early 2010s startup era. It is one of the most widely deployed NoSQL databases and is a default choice for many Node.js and JavaScript-stack applications.
MongoDB on port 27017 typically forms the data layer for a web application, a mobile backend, a content management system, or an analytics pipeline. In a typical sharded or replicated deployment, port 27017 carries the application’s traffic to the database router (mongos) or to a primary replica set member; additional ports (27018, 27019) carry replica set internal communication and config server traffic, but most application traffic terminates on 27017.
The MongoDB project also offers MongoDB Atlas, a managed cloud database service, which is the recommended deployment path for new applications because it handles authentication, network isolation, encryption in transit, and patching automatically. Self-hosted MongoDB deployments require the operator to configure those things explicitly.
In modern deployments, MongoDB is reachable from authorized application servers on internal networks or in private cloud subnets, never directly from the public internet. Outbound TCP/27017 from end-user devices is uncommon and usually indicates a database administration tool (MongoDB Compass, Studio 3T, or the command-line mongosh shell) connecting directly to a database server. Inbound TCP/27017 from the public internet is unusual in 2026 and is treated as a serious exposure.
About TCP Port 27017
Port 27017 carries the IANA assignment for mongodb. The IANA description reads: ‘Mongo database system’.
Security Considerations
The defining security event for port 27017 was the MongoDB ransom wave that began in late 2016 and continued through 2017. Attackers systematically scanned the internet for MongoDB instances reachable on port 27017, identified those that accepted connections without authentication (which was the default behavior in earlier MongoDB versions), exfiltrated or deleted the contents of the databases, and left ransom notes demanding payment in cryptocurrency for restoration. Tens of thousands of databases were affected over the course of the campaign, many belonging to small businesses, startups, and individual developers who had not realized their databases were exposed.
The root cause was a combination of two factors. Earlier versions of MongoDB shipped with a default configuration that bound the server to all network interfaces (rather than localhost only) and required no authentication for connections. Combined with the common practice of provisioning a cloud server, installing MongoDB with default settings, and connecting an application to it, the result was a large population of internet-reachable databases with no protection. The MongoDB project responded by changing the default bind address to 127.0.0.1 in MongoDB 3.6 (released December 2017), which prevents the database from accepting connections from anywhere other than the local host until an administrator explicitly configures it otherwise.
Our data shows just 1 IDS rule referencing port 27017, detecting an exploitation attempt for CVE-2025-14847, an unauthenticated memory leak vulnerability in MongoDB. The rule reflects a current detection effort against this specific issue. The thin rule count for port 27017 should not be read as low risk; rather, MongoDB attacks have historically been opportunistic ransom and data theft against misconfigured exposed instances, which most IDS rule sets do not flag rule-by-rule.
Common practice today is to use the secure defaults that modern MongoDB versions ship with, require authentication for all database access, run MongoDB only on internal networks or in private cloud subnets, use TLS for connections, and keep the server patched. For new applications, MongoDB Atlas is generally recommended over self-hosting because it handles network isolation and patching by default.
Inbound TCP/27017 from the public internet is unusual in 2026 and warrants immediate investigation if observed.
IDS Rule References
1 IDS / security rule reference TCP port 27017. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 1): attempted-admin (1).
Sample rule descriptions for TCP port 27017:
- ET EXPLOIT MongoDB Unauthenticated Memory Leak (CVE-2025-14847)
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry and Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range).