diff --git a/ChangeLog.txt b/ChangeLog.txt
index 3d6e13ee..1adb1d45 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -6,6 +6,11 @@ Security:
   These clients are now rejected if their keepalive value exceeds
   max_keepalive. This option allows CVE-2020-13849, which is for the MQTT
   v3.1.1 protocol itself rather than an implementation, to be addressed.
+- Using certain listener related configuration options e.g. `cafile`, that
+  apply to the default listener without defining any listener would cause a
+  remotely accessible listener to be opened that was not confined to the local
+  machine but did have anonymous access enabled, contrary to the
+  documentation. This has been fixed. Closes #2283.
 
 Broker:
 - Fix possible out of bounds memory reads when reading a corrupt/crafted
diff --git a/src/mosquitto.c b/src/mosquitto.c
index ab7a1e0d..776b71f0 100644
--- a/src/mosquitto.c
+++ b/src/mosquitto.c
@@ -335,7 +335,7 @@ static int listeners__start(void)
 
 	listensock_count = 0;
 
-	if(db.config->listener_count == 0){
+	if(db.config->local_only){
 		if(listeners__start_local_only()){
 			db__close();
 			if(db.config->pid_file){