Log in Start free

Vulnerability · Published Feb 12, 2026 · Assigned by fedora

CVE-2025-14282Dropbear: privilege escalation via unix domain socket forwardings

Medium 5.4

In plain English

A medium-severity security flaw in dropbear from https://github.com/mkj/dropbear/. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the remote client as root, only switching to the logged-in user upon spawning a shell or performing some operations like reading the user's files. With the recent ability of also using unix domain sockets as the forwarding destination any user able to log in via ssh can connect to any unix socket with the root's credentials, bypassing both file system restrictions and any SO_PEERCRED / SO_PASSCRED checks performed by the peer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24dropbear2025.89-r0ALPINE-CVE-2025-14282
Debian:13dropbear2025.89-1~deb13u1DEBIAN-CVE-2025-14282
Debian:13dropbear2025.89-1~deb13u1DSA-6086-1
Debian:14dropbear2025.89-1DEBIAN-CVE-2025-14282
Ubuntu:22.04:LTSdropbearno fix listedUBUNTU-CVE-2025-14282
Ubuntu:24.04:LTSdropbearno fix listedUBUNTU-CVE-2025-14282
Ubuntu:25.10dropbearno fix listedUBUNTU-CVE-2025-14282
Ubuntu:26.04:LTSdropbearno fix listedUBUNTU-CVE-2025-14282

Affected products (as reported)

VendorProductVersions
https://github.com/mkj/dropbear/ dropbear 2024.84 – before 2025.88

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References