SecurityFan score 20 · Tier C
Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven)
The Brief
- Dropbear's permitopen and permitlisten restrictions on SSH keys are not enforced for unix-socket forwarding.
- A restricted key can reach unix sockets such as docker.sock, according to the report, which says this was live-proven at HEAD 99baf182.
- The report was posted to oss-sec on 2026-11-13.
Why it matters
Operators who rely on Dropbear's restricted-key options to limit what an SSH key can reach may be exposed, since a socket like docker.sock can grant host-level control.
Who’s affected
- Teams running Dropbear SSH servers with restricted keys
- Operators of routers, embedded systems, rescue images and appliances that ship Dropbear
- #ssh
- #dropbear
- #security
- #vulnerability
- #docker
- #port-forwarding
Posted by theknell on Nov 13 Dropbear is the SSH server that ships where OpenSSH is too big: routers, embedded systems, rescue images, appliances — anywhere a small, hardened sshd is wanted. It has been fuzzed and audited for two decades, and its handling of restricted keys is…