---
title: "NET-DB-001 Database or Cache Service Exposed to the Network"
canonical: https://openvapt.com/checks/NET-DB-001.html
html: https://openvapt.com/checks/NET-DB-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-DB-001 Database or Cache Service Exposed to the Network

Checks whether databases, caches, search engines or the Docker API listen on a network-reachable address.

- Domain: Network
- Severity: High
- Control category: Data Services
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-1327, CWE-306
- OWASP Top 10 2021: A05:2021
- NIST SP 800-53 Rev. 5: SC-7, CM-7
- Benchmark topic: Network exposure of data services (topic only, no benchmark text)

## Why It Matters

Exposed databases and caches (Redis, MongoDB, Elasticsearch, Memcached) are among the most common causes of mass data breaches and ransom wipes, often because they ship without authentication.

## How It Detects

Matches network-reachable listening ports from /proc/net against a list of well-known data service ports (IANA registry).

## How to Fix

Bind the service to 127.0.0.1 (MySQL: bind-address = 127.0.0.1; Redis: bind 127.0.0.1 ::1 and protected-mode yes; MongoDB: net.bindIp: 127.0.0.1) and restart it. Caution: confirm first that no application on another machine connects to it, or that application loses its database. If remote access is needed, allow only specific source IPs in the firewall and require TLS and authentication.

## How to Verify

```
ss -tlnp | grep -E ':(3306|5432|6379|27017|9200|11211)'  should show only 127.0.0.1 or ::1.
```

## Learn the Theory

- [F1 Security Basics](https://openvapt.com/academy/f1.md)
- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P8 Data Services: Databases, File Shares, DNS and Mail](https://openvapt.com/academy/p8.md)

## References

- [OWASP Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html)
- [Redis security](https://redis.io/docs/latest/operate/oss_and_stack/management/security/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/listeners.go

Run it: `openvapt scan --only NET-DB-001`. Read it offline: `openvapt explain NET-DB-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-DB-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.