Opened exploitable ports in default docker-compose.yaml in go-ipfs
Summary
GHSA-fx5p-f64h-93xc: Opened exploitable ports in default docker-compose.yaml in go-ipfs. Affects github.com/ipfs/go-ipfs versions >= 0.11.0, < 0.12.1. Fixed in 0.12.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The go-ipfs package is an implementation of the InterPlanetary File System (IPFS) in the Go programming language. IPFS is a distributed file system that aims to connect all computing devices with the same system of files. It allows users to store and retrieve files in a decentralized manner, using content-addressing and cryptographic hashing. The go-ipfs package provides a command-line interface and an HTTP API for interacting with IPFS nodes.
Vulnerability Detail
The vulnerability in the default docker-compose.yaml file of go-ipfs allows admin API access to the IPFS node. In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as 0.0.0.0:5001 on the host machine. This means that if the host machine is directly attached to a public or untrusted IP, anyone can access the IPFS node's admin API. This can lead to unauthorized access and potential misuse of the IPFS node.
How To Fix
Latest published version: v0.13.1 as of 23 Oct 2026
go get github.com/ipfs/go-ipfs@v0.13.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.1
This is the first release that contains the fix.
go get github.com/ipfs/go-ipfs@v0.12.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended fix is to update the docker-compose.yaml file as mentioned above.
Conclusion
The default docker-compose.yaml file in go-ipfs exposes the private API endpoint as '0.0.0.0:5001' on the host machine, allowing unauthorized access to the IPFS node's admin API. To fix this vulnerability, users should update their docker-compose.yaml file to version 0.12.1 or later. It is recommended to follow security best practices and avoid exposing unnecessary dependencies on a working firewall. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ipfs/go-ipfs →
FAQ
This vulnerability allows unauthorized access to the IPFS node's admin API, which can lead to potential misuse of the IPFS node.
This vulnerability affects people running the docker-compose.yaml service in an environment where the docker host is directly attached to a public or untrusted IP.
You can check if you are vulnerable by running the 'netstat -lnp | grep ":5001"' command on the host machine. If the output shows listeners bound to ':5001' with '0.0.0.0' or a public IP, you are likely vulnerable.
You can test if the vulnerability is fixed by trying to contact the IPFS API from a remote machine using the 'curl -X POST http://<node_public_ip>:5001/api/v0/version' command. If the command fails, the vulnerability is fixed.
For more information, you can refer to the IPFS documentation on best practices for API usage, ask in the IPFS Discord channel, or open an issue in the go-ipfs GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ipfs/go-ipfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
