# Audit-log TCP peer attribution behind PROXY protocol > Source-anchored research for Audit-log TCP peer attribution behind PROXY protocol. Run status: COMPLETED. Parent: [MongoDB Security Architecture](https://llms-explorer.com/tree/mongodb-security-architecture/) · 4 facets · 16 facts · page: https://llms-explorer.com/tree/audit-log-tcp-peer-attribution-behind-proxy-protocol/ ## Structure and components - The mongo schema documents directRemote as new in 9.0 and also available starting in 8.3.9 and 8.0.33. Its document contains ip and port, or unix for a Unix domain socket. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - Starting in 8.1, audit records can preserve origin and intermediary addresses: mongo remote and OCSF src_endpoint can contain the origin address read from a PROXY header, while intermediates and src_endpoint.intermediate_ips record forwarding hosts. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) ## How it works - Zuul issue 2197 reports forged audit attribution when a PROXY-enabled listener is reachable directly. The discussion questions whether the behavior is deployment-dependent and proposes checking the actual TCP peer against trusted CIDRs. This is an issue-thread report, not proof of a MongoDB incident or a verified Zuul fix. (low confidence) (verified as of 2026-10-05) — [source](https://github.com/Netflix/zuul/issues/2197) ## Comparisons and alternatives - MongoDB documents directRemote in the mongo audit schema and direct_endpoint in its OCSF audit schema to distinguish the host opening a connection from a client address asserted by a load balancer or reverse proxy in a PROXY header. The direct connection can therefore identify a proxy rather than the original application client. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - The schemas represent Unix-domain connections differently: mongo directRemote uses a unix field instead of ip and port, while OCSF direct_endpoint uses interface set to unix and omits port. Audit normalization must account for that documented difference. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - The NDSS researchers attribute their demonstrated failures to implementation details and deployment misconfiguration, rather than an inherent protocol vulnerability. Teleport likewise requires deployments to prevent arbitrary direct access to listeners that trust PROXY headers. (high confidence) — [source](https://www.ndss-symposium.org/wp-content/uploads/2025-2247-paper.pdf) ## Facts and statements - The mongo schema documents directRemote as new in MongoDB 9.0 and also available starting in 8.3.9 and 8.0.33. The OCSF schema documents direct_endpoint as new in 9.0 and also available starting in 8.3.9; that page does not establish an 8.0.33 OCSF backport. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - Starting in MongoDB 8.1, mongos can record the PROXY-header client address in remote or src_endpoint. The load-balancer and mongos hops appear in intermediates or src_endpoint.intermediate_ips. Earlier mongo-schema logs instead placed the load-balancer or mongos address in remote and omitted that intermediate chain. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - MongoDB explicitly warns that any host able to reach its PROXY-protocol port can assert an arbitrary client address. Restrict that port to the trusted load balancer or reverse proxy; recording a direct peer does not authenticate the separate client-address assertion. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - For shard audit events, both schema references qualify the direct-address description: a request routed by mongos repeats the client address mongos forwards, whereas a request coming directly from mongos records the mongos address. Treating every shard directRemote or direct_endpoint value as a fresh observation of the shard socket peer would exceed the documented guarantee. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - Independent PROXY-protocol research demonstrates that accepting client-supplied PROXY headers from untrusted connections can poison backend logs and bypass address-based controls. Teleport independently documents the same audit-attribution hazard. These findings support the trust-boundary rationale, but do not establish an exploited MongoDB vulnerability. (high confidence) — [source](https://www.ndss-symposium.org/wp-content/uploads/2025-2247-paper.pdf) - The OCSF schema documents direct_endpoint as new in 9.0 and available starting in 8.3.9. For Unix domain sockets it stores interface set to unix and omits port; this page does not list an 8.0.33 backport. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/ocsf.md) - MongoDB warns that any host able to reach its PROXY-protocol port can assert an arbitrary client address. Restrict access to the load balancer or reverse proxy; independent Teleport guidance describes the same unauthenticated-header trust boundary. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md) - PROXY protocol conveys client information in a connection prefix; it does not provide built-in authentication of that asserted address. A forged header accepted from an untrusted sender can poison attribution in logs. (high confidence) — [source](https://goteleport.com/docs/zero-trust-access/management/security/proxy-protocol/) - The NDSS study scopes its demonstrated log-forging and access-control bypasses to implementation choices and misconfigured trust boundaries. Its evidence does not establish that enabling PROXY protocol alone makes every backend vulnerable. (medium confidence) — [source](https://www.ndss-symposium.org/wp-content/uploads/2025-2247-paper.pdf) - Operational inference: retain both the asserted origin and the direct-address field during audit ingestion, interpret each against the connection topology, and enforce trusted ingress separately. Recording a direct address improves evidence but does not authenticate a PROXY assertion. (medium confidence) — [source](https://www.mongodb.com/docs/manual/reference/audit-message/mongo.md)