Port 27017 and 1,676,736 Matches: Databases That Answer Before Anyone Authenticates

The count

ZoomEye returns 1,676,736 matches for port="27017", collected on 2026-09-24. Port 27017 is the default endpoint for MongoDB, a document database that holds records organizations treat as business data.
The count describes services answering on the port. No authentication was attempted and no data was retrieved.

Access control is a configuration step

MongoDB deployments require the operator to create administrative users and enable authorization explicitly; a default installation begins without access control enabled. That design assumes a controlled environment and a deployment process, and it holds up in environments where those assumptions are true.
The gap appears when an instance created for development is moved onto a public address, or when a container image is published with the database port mapped to the host network, or when a managed offer is provisioned with a permissive access list because the application's egress address changes frequently.

Why databases are enumerated rather than targeted

An open database port is found by scanning, which means the discovery step does not require the operator to know anything about the organization. That lowers the barrier to initial access below the level of a phishing campaign and makes an internet-reachable database one of the cheapest entry points available on a network.
Database access also tends to produce a data-centric outcome. An attacker who reaches the store does not need to move laterally to obtain records, and does not need to escalate privileges to read them.

Controls that hold up

Enable authorization and create named users with roles scoped to what each application needs. Where the deployment supports it, bind to specific interfaces and enable TLS so that the connection is authenticated in both directions.
Restrict reachability at the network layer. A database reachable only from the application subnet removes the exposure class, and private networking for managed offerings achieves the same result without depending on an access list staying correct over time.
Back up independently. A store that has been exposed may have been altered rather than only read, and a restore path that does not depend on the compromised instance is what makes the difference between a data exposure and a data loss.

Reviewing a deployment against the vendor checklist

The vendor publishes a security checklist that walks through authentication, network configuration, authorization roles, encryption and audit logging. Reading a deployment against that checklist is a faster way to find the missing step than reviewing configuration files line by line, and it produces a record that an auditor can follow.

Implications

For exposure work, the useful question about a database port is not how many services answer globally but whether any address the organization owns answers on it. That question has a yes-or-no answer, and the work that follows from a yes is well defined.

References

• ZoomEye search for port="27017": https://www.zoomeye.ai/
• MongoDB security documentation: https://www.mongodb.com/docs/manual/security/
• MongoDB security checklist: https://www.mongodb.com/docs/manual/administration/security-checklist/