Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-14282 EUVD-2025-207001GHSA-xqcm-jrw9-wq72

Dropbear: privilege escalation via unix domain socket forwardings

Published Feb 12, 2026 · Updated Feb 18, 2026 · Assigned by fedora

Description

A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the remote client as root,
only switching to the logged-in user upon spawning a shell or performing
some operations like reading the user's files.
With the recent ability of also using unix domain sockets as the forwarding destination any user able to log in via ssh can connect to any unix socket with the root's credentials, bypassing both file system restrictions and any SO_PEERCRED / SO_PASSCRED checks performed by the peer.

Affected products

VendorProductAffectedFixed
https://github.com/mkj/dropbear/ dropbear 2024.84 – < 2025.88 2025.88

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 dropbear 2025.89-1 —
Debian 13 dropbear 2025.89-1~deb13u1 DSA-6086-1
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS dropbear No fix yet —
Ubuntu 25.10 dropbear No fix yet —
Ubuntu 24.04 LTS dropbear No fix yet —
Ubuntu 22.04 LTS dropbear No fix yet —
Ubuntu 16.04 LTS dropbear No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS dropbear No fix yet —
Ubuntu Pro 18.04 LTS dropbear No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 dropbear 2025.89-r0 —

Advisories 2

References