diff --git a/cli/config/configfile/file.go b/cli/config/configfile/file.go
index 67ae655b0b..388a5d54d6 100644
--- a/cli/config/configfile/file.go
+++ b/cli/config/configfile/file.go
@@ -123,9 +123,11 @@ func (configFile *ConfigFile) LoadFromReader(configData io.Reader) error {
 	}
 	var err error
 	for addr, ac := range configFile.AuthConfigs {
-		ac.Username, ac.Password, err = decodeAuth(ac.Auth)
-		if err != nil {
-			return err
+		if ac.Auth != "" {
+			ac.Username, ac.Password, err = decodeAuth(ac.Auth)
+			if err != nil {
+				return err
+			}
 		}
 		ac.Auth = ""
 		ac.ServerAddress = addr
diff --git a/cli/config/configfile/file_test.go b/cli/config/configfile/file_test.go
index dc00572677..83574bf85c 100644
--- a/cli/config/configfile/file_test.go
+++ b/cli/config/configfile/file_test.go
@@ -2,6 +2,7 @@ package configfile
 
 import (
 	"bytes"
+	"encoding/json"
 	"io/ioutil"
 	"os"
 	"testing"
@@ -380,6 +381,41 @@ func TestGetAllCredentialsCredHelperOverridesDefaultStore(t *testing.T) {
 	assert.Check(t, is.Equal(0, testCredHelper.(*mockNativeStore).GetAllCallCount))
 }
 
+func TestLoadFromReaderWithUsernamePassword(t *testing.T) {
+	configFile := New("test-load")
+	defer os.Remove("test-load")
+
+	want := types.AuthConfig{
+		Username: "user",
+		Password: "pass",
+	}
+
+	for _, tc := range []types.AuthConfig{
+		want,
+		{
+			Auth: encodeAuth(&want),
+		},
+	} {
+		cf := ConfigFile{
+			AuthConfigs: map[string]types.AuthConfig{
+				"example.com/foo": tc,
+			},
+		}
+
+		b, err := json.Marshal(cf)
+		assert.NilError(t, err)
+
+		err = configFile.LoadFromReader(bytes.NewReader(b))
+		assert.NilError(t, err)
+
+		got, err := configFile.GetAuthConfig("example.com/foo")
+		assert.NilError(t, err)
+
+		assert.Check(t, is.DeepEqual(want.Username, got.Username))
+		assert.Check(t, is.DeepEqual(want.Password, got.Password))
+	}
+}
+
 func TestCheckKubernetesConfigurationRaiseAnErrorOnInvalidValue(t *testing.T) {
 	testCases := []struct {
 		name        string