diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index 65393399d5..06523c7c9b 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -620,7 +620,7 @@ static int32_t mndProcessCreateUserReq(SRpcMsg *pReq) {
     goto _OVER;
   }
 
-  if (createReq.user[0] == 0) {
+  if (createReq.user[0] == 0 || strlen(createReq.pass) >= TSDB_PASSWORD_LEN) {
     terrno = TSDB_CODE_MND_INVALID_USER_FORMAT;
     goto _OVER;
   }