# Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/690) · 2026-11-13 · Security
Page: https://themorning.dev/story/dropbear-the-restriction-names-an-address-permitopen-permitlisten-not-enforced-f-47aa05ab73b6add8
Kind: security · Impact: medium

## In brief

- Dropbear's permitopen and permitlisten restrictions on SSH keys are not enforced for unix-socket forwarding.
- A restricted key can reach unix sockets such as docker.sock, according to the report, which says this was live-proven at HEAD 99baf182.
- The report was posted to oss-sec on 2026-11-13.

## Why it matters

Operators who rely on Dropbear's restricted-key options to limit what an SSH key can reach may be exposed, since a socket like docker.sock can grant host-level control.

## Timeline

- 2026-11-13: Issue disclosed on the oss-sec mailing list

## Coverage

- [Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven)](https://seclists.org/oss-sec/2026/q4/690) — Open Source Security, 2026-11-13

Tags: ssh, dropbear, security, vulnerability, docker, port-forwarding

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev