diff --git a/.changelog/2968.txt b/.changelog/2968.txt
new file mode 100644
index 0000000000..70a4e82bee
--- /dev/null
+++ b/.changelog/2968.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/tencentcloud_cynosdb_cluster: suppor `password` modification
+```
\ No newline at end of file
diff --git a/tencentcloud/services/cynosdb/extension_cynosdb.go b/tencentcloud/services/cynosdb/extension_cynosdb.go
index f75c3f5786..821ed50222 100644
--- a/tencentcloud/services/cynosdb/extension_cynosdb.go
+++ b/tencentcloud/services/cynosdb/extension_cynosdb.go
@@ -181,7 +181,6 @@ func TencentCynosdbClusterBaseInfo() map[string]*schema.Schema {
 		"password": {
 			Type:        schema.TypeString,
 			Required:    true,
-			ForceNew:    true,
 			Sensitive:   true,
 			Description: "Password of `root` account.",
 		},
diff --git a/tencentcloud/services/cynosdb/resource_tc_cynosdb_cluster.go b/tencentcloud/services/cynosdb/resource_tc_cynosdb_cluster.go
index 1a83e7b365..cee22a7e0f 100644
--- a/tencentcloud/services/cynosdb/resource_tc_cynosdb_cluster.go
+++ b/tencentcloud/services/cynosdb/resource_tc_cynosdb_cluster.go
@@ -795,6 +795,26 @@ func resourceTencentCloudCynosdbClusterUpdate(d *schema.ResourceData, meta inter
 		}
 	}
 
+	// update root pwd
+	if d.HasChange("password") {
+		request := cynosdb.NewResetAccountPasswordRequest()
+		request.ClusterId = helper.String(clusterId)
+		request.AccountName = helper.String("root")
+		request.AccountPassword = helper.String(d.Get("password").(string))
+		err := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
+			_, err := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseCynosdbClient().ResetAccountPassword(request)
+			if err != nil {
+				return tccommon.RetryError(err)
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+
 	// update tags
 	if d.HasChange("tags") {
 		oldTags, newTags := d.GetChange("tags")
diff --git a/website/docs/r/cynosdb_cluster.html.markdown b/website/docs/r/cynosdb_cluster.html.markdown
index 9e2d9c241f..f00a2ed564 100644
--- a/website/docs/r/cynosdb_cluster.html.markdown
+++ b/website/docs/r/cynosdb_cluster.html.markdown
@@ -198,7 +198,7 @@ The following arguments are supported:
 * `cluster_name` - (Required, String) Name of CynosDB cluster.
 * `db_type` - (Required, String, ForceNew) Type of CynosDB, and available values include `MYSQL`.
 * `db_version` - (Required, String, ForceNew) Version of CynosDB, which is related to `db_type`. For `MYSQL`, available value is `5.7`, `8.0`.
-* `password` - (Required, String, ForceNew) Password of `root` account.
+* `password` - (Required, String) Password of `root` account.
 * `subnet_id` - (Required, String) ID of the subnet within this VPC.
 * `vpc_id` - (Required, String) ID of the VPC.
 * `auto_pause_delay` - (Optional, Int) Specify auto-pause delay in second while `db_mode` is `SERVERLESS`. Value range: `[600, 691200]`. Default: `600`.