password with trailing space not accepted

[Stricken1670]

Description

I used to have a password with a trailing space and it wasn't accepted. Changing the password without the trailing space fixed the problem.

Reproduce

• I tried with a docker-distribution and a harbor repo and with both it didn't work.
• I tried with docker login and prinf 'passwd'|docker login --username u.name --password-stdin

Expected behavior

No response

docker version

Client: Docker Engine - Community
 Version:           29.2.1
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        a5c7197
 Built:             Mon Feb  2 17:21:00 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.2.1
  API version:      1.53 (minimum version 1.44)
  Go version:       go1.25.6
  Git commit:       6bc6209
  Built:            Mon Feb  2 17:16:59 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    29.2.1
 Context:    default
 Debug Mode: false
 Plugins:
  compose: Docker Compose (Docker Inc.)
    Version:  v5.0.2
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 5
  Running: 0
  Paused: 0
  Stopped: 5
 Images: 15
 Server Version: 29.2.1
 Storage Driver: overlay2
  Backing Filesystem: btrfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.18.8-200.fc43.x86_64
 Operating System: Fedora Linux 43 (Workstation Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 15.47GiB
 Name: habocp3.axis-flight-training-systems.at
 ID: b414d674-4b37-4ec1-bff0-63738b7bf5f5
 Docker Root Dir: /home/docker-data
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  registry.lat.internal
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables

Additional Info

No response

[Stricken1670]

Passwords should be treated as opaque byte sequences. Any transformation (trimming, normalization, case folding) is a security bug. The fact that a trailing space breaks authentication means something is done to the password beyond just passing it through, which is fundamentally wrong.

This is a security bug.

[thaJeztah]

Thanks for reporting; looks like this was introduced in a21a5f4

We could make it slightly more strict (there's handling for reading from STDIN to only trim trailing newlines (CR, LF, CRLF)). That said, NIST guidelines (NIST SP 800-63B §3.1.1.2) documents;

Verifiers MAY make limited allowances for mistyping (e.g., removing leading and trailing whitespace characters before verification, allowing the verification of passwords with differing cases for the leading character) if the password remains at least the required minimum length after such processing and the complexity of the resulting password is not significantly reduced.

Technically, that would be during verification (in our case, the trimming happens on input), but I definitely don't think this is a security issue. Not sure as well if we should change the behavior; it's not unlikely that other parts in the flow, which can be on the registry side, would trim these values as well, potentially leading to more confusion.