CVE-2018-12608

Docker Authentication Bypass

7.5 HighFix available

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.92%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2018-12608
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-12608
Updated: 2026-11-02

EUVDEUVD-2024-0408 No score

Record: EUVD-2024-0408
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qrqr-3x5j-2xw9 7.5

Docker Authentication Bypass

Record: GHSA-qrqr-3x5j-2xw9
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-288
Updated: 2026-11-02

OSV 7.5

Record: CVE-2018-12608
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-12608 7.5

Record: DEBIAN-CVE-2018-12608
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-qrqr-3x5j-2xw9 7.5

Docker Authentication Bypass

Record: GHSA-qrqr-3x5j-2xw9
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-288
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-12608 7.5

Record: UBUNTU-CVE-2018-12608
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

mobyproject moby

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/docker/docker` Go	before 17.06.0-ce	17.06.0-ce
`docker.io` Debian:12	before 18.03.1+dfsg1-2	18.03.1+dfsg1-2
`docker.io` Debian:13	before 18.03.1+dfsg1-2	18.03.1+dfsg1-2
`docker.io` Debian:14	before 18.03.1+dfsg1-2	18.03.1+dfsg1-2
`docker.io` Ubuntu:16.04:LTS	before 18.06.1-0ubuntu1~16.04.2, plus listed versions 1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4 Show 8 moreShow less 1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.1	18.06.1-0ubuntu1~16.04.2
`docker.io` Ubuntu:18.04:LTS	before 18.06.1-0ubuntu1~18.04.1, plus listed versions 1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1	18.06.1-0ubuntu1~18.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12608 is a high vulnerability (CVSS 7.5) in Mobyproject Moby, published September 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in github.com/docker/docker 17.06.0-ce.