International
The Morning Dev

Only the news worth knowing

‹
 
C20/100

Vulnerability · medium

Dropbear SSH restrictions not enforced for unix-socket forwarding

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Dropbear servers using permitopen or permitlisten restricted keys

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

  • Dropbear's permitopen and permitlisten restrictions on SSH keys are not enforced for unix-socket forwarding.
  • A restricted key can reach unix sockets such as docker.sock, according to the report, which says this was live-proven at HEAD 99baf182.
  • The report was posted to oss-sec on 2026-11-13.

Why it matters

Operators who rely on Dropbear's restricted-key options to limit what an SSH key can reach may be exposed, since a socket like docker.sock can grant host-level control.

The checklist behind the tier

Checklist · 1 of 10 yes
YesHits tech teamsJudgment: Dropbear is an SSH server run by ops and IT on routers, appliances and rescue images.
NoCore infrastructureJudgment: Dropbear is a small embedded sshd, not core software nearly every team runs like OpenSSH.
NoPopular toolJudgment: Dropbear is embedded in many devices but is not mainstream developer tooling used by many teams.
NoExploited in the wildOpen Source Security: the post reports a live-proven flaw, not observed attacks in the wild.
NoPublic exploitOpen Source Security: the post describes a live proof, but does not say exploit code or a PoC is published.
NoRemote, no loginOpen Source Security: the flaw concerns restricted keys, implying an authenticated SSH login is needed.
NoFull takeoverOpen Source Security: the source says docker.sock is reachable but does not state code execution or root.
NoSecrets exposedOpen Source Security: the source reports no stolen or exposed credentials, configs or data.
NoSupply chainOpen Source Security: a normal authorization bug in legitimate code, not malicious code shipped through a trusted channel.
NoNo fix yetOpen Source Security: the source does not say whether a patched version exists.

Timeline

  1. Issue disclosed on the oss-sec mailing list

  2. Open Source Security

    Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven)

Source

Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven) ↗ Open Source Security · 3h ago

First seen · 1 source · Full story page · How tiers are decided