Tailscale Fixes SSH Flaws That Could Give Attackers Root Access

Tailscale has rolled out fixes for serious security flaws that could let an authorized user or compromised device gain root-level control of connected servers. Households and small offices using Tailscale SSH should update every Tailscale device and review who can connect, especially if they use the service for personal servers or remote work systems.

What happened

Researchers at Cyberdione Labs disclosed 11 security problems found while testing Tailscale client version 1.104.2 and the self-hosted headscale control server version 0.29.5. Six findings were rated high severity, according to SecurityWeek.

Four of the reported flaws involve Tailscale SSH, a feature that lets approved users and devices connect without traditional SSH passwords or keys. The researchers found that safeguards around some operations performed with root privileges could be bypassed.

An attacker would already need an authorized foothold, such as control of a device allowed to connect through Tailscale SSH. From there, the flaws could allow the attacker to exceed the permissions of the configured local user. Lab demonstrations resulted in root access and theft of keys that could be used to add unauthorized devices to the private network.

The researchers also showed that an automated attack could move between servers allowed by the same SSH policy without further user interaction. Other findings involved Tailscale features including Serve, an experimental app connector and relay components, as well as headscale.

Tailscale initially said it was preparing a patched client. SecurityWeek later reported that the company had published its findings, security bulletins and fixes. The source reports do not identify a specific numbered fixed release. Neither Tailscale nor the researchers reported exploitation in real-world attacks.

Who is affected

The clearest risk applies to people and small offices that use Tailscale SSH to reach servers and permit SSH forwarding. Risk depends on which users and devices are authorized, the systems they can reach and how the access policy is configured.

The public research tested Tailscale 1.104.2 and headscale 0.29.5. Other affected or fixed versions have not been specified in the provided reports. Ordinary Tailscale users who do not enable Tailscale SSH may still want to update because some findings involved other components.

What to do now

1. Update Tailscale on every connected device. Open the Tailscale app or your operating system’s software-update tool and install the newest client offered. Do this on servers as well as laptops and desktops; updating only one device does not protect the rest of the network.

2. Check whether Tailscale SSH is enabled. Review your Tailscale configuration and access policies. Identify every user and device allowed to make SSH connections, then remove access that is no longer needed.

3. Turn off unnecessary SSH forwarding. Tailscale specifically advised disabling forwarding where it is not required because that reduces exposure to several of the more serious findings. The exact configuration depends on your policy setup.

4. Review connected devices for anything unfamiliar. Because the demonstrated attack could steal keys used to add rogue devices, investigate and remove any device you do not recognize. Also examine systems that were reachable from a lost, stolen or compromised device.

5. Watch Tailscale’s security guidance for the fixed version. BleepingComputer reported that Tailscale considered the issues serious but did not recommend that every user disable Tailscale SSH. Verify that all of your devices are running a release covered by the final security bulletins.