MongoDB wire protocol
The MongoDB wire protocol is the message format MongoDB's own drivers and the mongosh shell use to communicate with a mongod or mongos process over TCP, normally on port 27017, which IANA registers for MongoDB. It's MongoDB-specific rather than a shared database standard, documented directly in MongoDB's manual rather than an independent spec body. Before version 3.6, MongoDB's binaries bound to all network interfaces with authentication off by default, so a server stood up with no extra configuration spoke this protocol to anyone who could reach it over the network -- the exposure a wave of 2017 ransom attacks exploited at scale, wiping tens of thousands of unauthenticated instances. Since 3.6, MongoDB binds to localhost by default, so an internet-reachable port 27017 today usually means an administrator deliberately widened net.bindIp, often without also enabling authentication.
By AdminKit team, Netbase JSC · Updated