Exposed Docker Daemon API

Critical Severity Technical Guide

Vulnerability Description

Exposing the Docker Daemon TCP socket without encryption or authentication allows anyone to control the host OS, spin up malicious containers, and execute arbitrary root-level code.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Never bind the Docker socket (port 2375/2376) to public IP addresses. Secure the socket with mutual TLS (mTLS) or restrict access to local Unix sockets.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.