CVE-2018-20587
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1...
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
- Record
CVE-2018-20587- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
- Record
CVE-2018-20587- Updated
- 2026-11-02
EUVDEUVD-2018-13140 No score
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
- Record
EUVD-2018-13140- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rr2v-hv85-27hv
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1...
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
- Record
GHSA-rr2v-hv85-27hv- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
- Record
CVE-2018-20587- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11073-1 No score
bitcoin-qt6-31.0-2.1 on GA media
These are all security issues fixed in the bitcoin-qt6-31.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11073-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21149-1 No score
Security update for bitcoin
This update for bitcoin fixes the following issues:
Changes in bitcoin:
- Reference the tracking bugs for CVEs already fixed in current bitcoin
(the affected versions all predate the shipped release):
- CVE-2018-20587 (boo#1125092)
- CVE-2019-15947 (boo#1149711)
- CVE-2020-14198 (boo#1181786)
- CVE-2021-3195 (boo#1181784)
- CVE-2023-37192 (boo#1217678)
- CVE-2024-35202 (boo#1231507)
- Record
openSUSE-SU-2026:21149-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20587 is a medium vulnerability (CVSS 5.5) in Bitcoin Core, published February 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in bitcoin 31.0-2.1.
References
en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
medium.com/%40lukedashjr/cve-2018-20587-advisory-and-full-disclosure-a3105551e78b
nvd.nist.gov/vuln/detail/CVE-2018-20587
github.com/advisories/GHSA-rr2v-hv85-27hv
suse.com/security/cve/CVE-2018-20587
Show 11 moreShow less
bugzilla.suse.com/1125092