OneDB v3.1.0

Release Date: July 2026
Release Type: Feature and Security Enhancement Release
Branch: 3.1.0

OneDB v3.1.0 expands the MongoDB capabilities introduced in OneDB v3.0.0 by adding secure TLS connectivity and comprehensive MongoDB Protection Rules.

This release enables encrypted MongoDB client and backend connections, introduces protection against potentially unsafe or resource-intensive MongoDB commands, and enhances Query Audit with persisted Protection Rule information and multi-rule detection.

New Features

MongoDB Secure Connection

OneDB now supports secure TLS connections for MongoDB traffic on both sides of the OneDB deployment.

Client-to-OneDB TLS

MongoDB clients can connect securely to a TLS-enabled OneDB Listener using:

  • MongoDB Compass
  • mongosh
  • Compatible MongoDB drivers
  • Other applications using the MongoDB wire protocol

The MongoDB TLS connection is established before OneDB processes the MongoDB wire protocol, ensuring that client traffic is encrypted from the start of the connection.

OneDB-to-MongoDB TLS

OneDB can also establish a secure TLS connection to the target MongoDB server.

Backend TLS is enabled using the existing Secure Connection setting on the MongoDB Connection configuration.

MongoDB backend TLS is supported across OneDB database operations, including:

  • Connection validation
  • Field discovery
  • Database Browser operations
  • Migration-related database access
  • Listener traffic forwarding

Certificate Subject Alternative Name Support

MongoDB clients can validate the OneDB Listener certificate using a hostname or IP address included in the certificate Subject Alternative Name, or SAN.

This enables MongoDB Compass and other MongoDB clients to connect with hostname validation enabled without requiring insecure hostname-bypass options.

For a trusted connection, the hostname or IP address used by the MongoDB client must be included in the OneDB Listener certificate SAN.

Runtime Listener Reconciliation

Saving changes to a database Connection now triggers runtime reconciliation for dependent Listeners.

This allows MongoDB Listeners to apply updated backend Secure Connection settings without requiring a complete OneDB application restart.

MongoDB Protection Rules

OneDB v3.1.0 introduces dedicated Protection Rules for MongoDB connections.

The MongoDB Protection Rules interface is organized into the following categories:

  • Query Protection
  • Extraction Protection
  • Performance Protection
  • Command Injection Protection

Customer-configurable MongoDB Protection Rules use MONITOR mode and are disabled by default. Administrators can review and enable the rules based on their security and operational requirements.

MongoDB Query Protection

Collection Full Scan

Detects MongoDB queries that may scan an entire collection without an effective filter.

This rule can help identify queries that may cause unnecessary database processing or expose a broad set of documents.

MongoDB Extraction Protection

Broad Document Result

Detects MongoDB operations that may return an excessively broad document result.

Large Result Set

Detects MongoDB operations that exceed a configurable result-size threshold.

The threshold must be configured using a positive integer. Invalid or missing threshold values are handled safely without causing unexpected blocking or runtime failures.

MongoDB Performance Protection

Excessive Pipeline Stages

Detects aggregation commands containing more pipeline stages than the configured threshold.

The default threshold is:

10 pipeline stages

Unbounded Sort

Detects MongoDB sort operations that do not include an appropriate result limit.

This rule does not require a configurable threshold.

Large Skip

Detects MongoDB commands using an excessive skip value.

The default threshold is:

10000

These rules can help administrators identify commands that may consume excessive database resources or negatively affect application performance.

MongoDB Command Injection Protection

$where JavaScript

Detects the use of the MongoDB $where operator, which allows JavaScript expressions to be executed as part of a query.

Server-Side JavaScript

Detects supported server-side JavaScript operators within MongoDB aggregation pipelines, including:

  • $function
  • $accumulator

Unsafe Regular Expression

Detects potentially unsafe regular expressions based on:

  • Excessive regular-expression pattern length
  • Clearly risky repeated wildcard structures

The default maximum regular-expression pattern length is:

256 characters

MongoDB Command Injection Protection currently evaluates supported find and aggregate command paths.

Query Audit Enhancements

Persisted Protection Rule IDs

MongoDB Query Audit events now include the actual persisted Protection Rule ID associated with a detected protection condition.

This provides better traceability between:

  • Query Audit events
  • Connection Protection Rule configuration
  • Security Rule definitions
  • Protection Rule mode and status

Multi-Rule Evaluation

A single MongoDB request can match multiple Protection Rules.

When this occurs, OneDB records one Query Audit event containing snapshots of all matching Protection Rules.

For example, one aggregation request may simultaneously match:

  • Excessive Pipeline Stages
  • Large Skip
  • Unsafe Regular Expression

The audit event preserves the persisted Security Rule identifier for each matched rule.

MongoDB Response Protection

Response Masking Fail-Closed Protection

OneDB now includes persisted protection for MongoDB response-masking failures.

When a protected MongoDB response cannot be masked safely, OneDB blocks the response instead of forwarding potentially unprotected data to the client.

This protection uses the internal:

MONGODB_RESPONSE_MASKING_FAIL_CLOSED

Protection Rule.

The rule is enabled by default in BLOCK mode.

Database Visibility Fail-Closed Protection

OneDB also includes fail-closed protection for unsafe MongoDB database-visibility filtering.

If OneDB cannot safely apply database visibility restrictions to a listDatabases response, the response is blocked.

This protection uses the internal:

MONGODB_DATABASE_VISIBILITY_FAIL_CLOSED

Protection Rule.

The rule is enabled by default in BLOCK mode.

Sanitized Response-Protection Auditing

MongoDB response-protection audit events use sanitized action information.

Audit records do not include:

  • Raw BSON payloads
  • Protected document values
  • Sensitive response content
  • Raw exception details
  • TLS payload content

Unsafe MongoDB responses remain blocked even when the corresponding internal Protection Rule cannot be resolved from the runtime rule registry.

Security Enhancements

  • Added secure MongoDB frontend and backend TLS handling.
  • Added safe TLS handshake processing for non-TLS traffic, connection timeouts, and client-side handshake failures.
  • Prevented raw MongoDB packets and TLS payloads from being written to application logs during TLS handshake failures.
  • Added fail-closed handling for MongoDB document-masking failures.
  • Added fail-closed handling for MongoDB database-visibility filtering failures.
  • Added recursive inspection for supported MongoDB JavaScript operators.
  • Added unsafe regular-expression detection.
  • Added positive-integer validation for configurable MongoDB Protection Rule thresholds.
  • Added safe handling for missing or invalid Protection Rule configuration values.

Upgrade and Compatibility Notes

Existing MongoDB Connections

During upgrade, OneDB automatically adds missing MongoDB Protection Rule records to existing MongoDB Connections.

The upgrade process is idempotent and does not overwrite existing rule configuration, including:

  • Protection mode
  • Enabled or disabled status
  • Configured threshold values

Secure Connection Configuration

No MongoDB-specific TLS configuration is required under Site Configurations.

OneDB continues to use the existing Secure Connection architecture:

  • Listener Secure Connection controls frontend TLS between the MongoDB client and OneDB.
  • Connection Secure Connection controls backend TLS between OneDB and the MongoDB server.

These two settings are independent and may be enabled separately according to the deployment requirements.

MongoDB Client Certificate Trust

For self-signed certificates or certificates issued by a private certificate authority, the OneDB Listener public certificate must be trusted by the MongoDB client.

When connecting MongoDB Compass through OneDB, MongoDB Compass must trust the OneDB Listener certificate, not the certificate installed on the backend MongoDB server.

Replacing the OneDB Listener certificate may require the updated public certificate to be imported into the MongoDB client again.

The tlsAllowInvalidHostnames option should only be used temporarily for troubleshooting. It is not required when the hostname or IP address used by the client matches an entry in the certificate SAN.

Notes

  • MongoDB customer-configurable Protection Rules are disabled by default and use MONITOR mode.
  • Internal MongoDB response-protection rules are enabled by default and use BLOCK mode.
  • Internal response-protection rules are not displayed in the customer-facing Protection Rule tabs.
  • MongoDB Performance Protection does not include Expensive Aggregation in OneDB v3.1.0.
  • Server-side JavaScript detection currently covers $function and $accumulator within supported aggregation pipelines.
  • MongoDB mapReduce and eval are not included because they are outside the MongoDB command paths currently inspected by OneDB.

Release Summary

OneDB v3.1.0 delivers secure MongoDB connectivity and expanded MongoDB policy protection.

The release adds separate frontend and backend TLS support, trusted MongoDB Compass connections, certificate SAN validation, runtime Listener reconciliation, MongoDB Query, Extraction, Performance, and Command Injection Protection Rules, enhanced Query Audit rule traceability, multi-rule detection, and fail-closed protection for unsafe MongoDB responses.