Currently, if an arbiter is part of a replica set with auth enabled, it can only be accessed by other members of the set. Users cannot authenticate against the arbiter to run any administrative commands (except for db.isMaster).

A user should be able to authenticate to an arbiter and run administrative commands such as db.serverStatus. This could be implemented by allowing the arbiter to verify the user's auth credentials against the primary of the set.