In a auth-enabled server bound to localhost, the localhost exception allows an unauthenticated user to run a tiny set of commands (e.g. createUser and createRole) in order to bootstrap the server and create the initial set of users. Under this mode, a createUser command is permitted if the authentication database is either "admin" or "$external" (see AuthorizationSessionImpl::_getDefaultPrivileges in authorization_session_impl.cpp). Once a user is created in either of those DBs, the localhost exception is expected to close and start requiring authorization on the exempted commands. This works fine if the first user is created in the "admin" database, and this is the case that is well-tested. However, if the first user is created in the "$external" database, the localhost exception remains open, so if a user only ever creates a user in "$external" during setup, assuming that auth will be enforced fully afterwards, an attacker can connect and still create users that could be granted root privileges.