diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index 65393399d5..cbde56a860 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -630,6 +630,11 @@ static int32_t mndProcessCreateUserReq(SRpcMsg *pReq) {
     goto _OVER;
   }
 
+  if (strlen(createReq.pass) >= TSDB_PASSWORD_LEN){
+    terrno = TSDB_CODE_PAR_NAME_OR_PASSWD_TOO_LONG;
+    goto _OVER;
+  }
+
   pUser = mndAcquireUser(pMnode, createReq.user);
   if (pUser != NULL) {
     terrno = TSDB_CODE_MND_USER_ALREADY_EXIST;
diff --git a/tests/system-test/1-insert/boundary.py b/tests/system-test/1-insert/boundary.py
index 29dcbc7c46..4476236ca6 100644
--- a/tests/system-test/1-insert/boundary.py
+++ b/tests/system-test/1-insert/boundary.py
@@ -33,7 +33,7 @@ class TDTestCase:
         self.colname_length_boundary = self.boundary.COL_KEY_MAX_LENGTH
         self.tagname_length_boundary = self.boundary.TAG_KEY_MAX_LENGTH
         self.username_length_boundary = 23
-        self.password_length_boundary = 128
+        self.password_length_boundary = 31
     def dbname_length_check(self):
         dbname_length = randint(1,self.dbname_length_boundary-1)
         for dbname in [tdCom.get_long_name(self.dbname_length_boundary),tdCom.get_long_name(dbname_length)]: