1,436,696 Hosts on Port 2375: The Unauthenticated Docker API as a Persistent Surface

Port 2375 is the conventional unencrypted Docker daemon socket. Access to that socket is equivalent to root on the host, which makes its exposure one of the clearest examples of a high-impact misconfiguration.

The problem and why it matters

The Docker daemon runs with high privileges. A client that can reach the API can create containers, mount host paths, and in many configurations escape to the host. There is no meaningful privilege boundary between API access and host control.

The unencrypted port is intended for local development and for environments where the network is already trusted. Publishing it to the internet removes that assumption entirely.

Context and method

ZoomEye was queried with port="2375" using sub_type=all and a page size of one. The query returned 1,436,696 matches.

This is a port-based query. It reports addresses where port 2375 was observed as open. It does not confirm that the service behind the port is a Docker daemon, that it is unauthenticated, or that it is reachable from arbitrary sources.

Analysis: why a port count is the right measure here

The subject of this measurement is the exposed port itself, so a port query is appropriate. The number reflects how many addresses have that port open, which is a broader set than addresses running an unauthenticated daemon.

Even with that caveat, the count is large enough to be useful. It establishes that the port is widely reachable, which is the precondition for the misconfiguration to matter. The vulnerability is not in the port; it is in what the port exposes when the daemon is configured without TLS and without authentication.

The distinction between an open port and an exploitable daemon is the difference between a lead and a finding. Treating the count as a count of compromised hosts would be inaccurate.

Implications and next steps

• Never expose the unauthenticated daemon socket to an untrusted network. Use a local socket or an SSH tunnel for remote administration.
• Where remote API access is required, enable TLS with client certificate authentication and restrict source addresses.
• Audit cloud security groups and firewall rules for rules that permit port 2375 from the internet.
• Monitor for unexpected container creation and for containers that mount host paths.
• Use ZoomEye against your own ranges to confirm that no daemon socket has become reachable.

The limitation is inherent to port scanning. An open port is a precondition, not proof of exploitation, and a closed port on the scanned address does not prove the daemon is unreachable through another path.

References

• Docker documentation, Configure remote access for Docker daemon.
• Docker documentation, Docker Engine security.
• ZoomEye query executed for this article: port="2375", 1,436,696 matches, collected 2026-09-23 with sub_type=all.