I don't use MongoDB but other, generic recommendations apply and would likely go a long way towards preventing this: - deny (all) incoming traffic by default

I don't use MongoDB but other, generic recommendations apply and would likely go a long way towards preventing this: - deny (all) incoming traffic by default - permit only desired traffic (to specific ports) from specific hosts - avoid binding (listening) to interfaces you don't need to - set up / verify authentication is in place In addition to the link to the security manual that cpolis posted, there's also a MongoDB Security Checklist [0]. [0]: https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec...