Tailscale Fixes Multiple Critical Vulnerabilities Including Root Access and DoS
TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
We released Tailscale version 1.98.9 to address several critical security flaws, including an SSH vulnerability that allowed attackers to bypass ACLs and gain root access via malformed usernames. The update also patches a denial-of-service issue in Tailscale Serve and Funnel caused by infinite loops, alongside fixes for insecure Unix socket handling and OAuth token leakage in audit logs.
Specifically, if a user connected with the username -i this would have been interpreted as --no-idn and getent would have printed the entire passwd file contents starting with the root user, causing Tailscale to open an interactive root session.
- tptacek
This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to.
(If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)
- traceroute66
At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups.
But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years.
We very much fear at $work that there are vulnerabilities in the Tailscale product awaiting discovery. Especially as, AFAIK, Tailscale have never had a formal security audit on their software.
So we install it on hardened bastion hosts in an old-school "jump host" model. So people can still get access to where they need to be, but we don't need to install Tailscale's unaudited shit on every single server / vm / etc.
And we only use Tailscale as a glorified VPN, we don't use their hundreds of extra random features like this SSH one.
In terms of SSH, we use old-school OpenSSH and SSH certificates. Its really not that difficult and its really not expensive, you can do offline signing with Yubikeys, no need for expensive HSMs.
- doublepg23
I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature.
I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.
- jcarrano
> usernames were passed as arguments to getent(1) to retrieve the corresponding passwd entry
Always try to use actual API/system calls (in this case getpwnam) instead of calling sub-processes.
- drnick1
I'll stick to my 100% self-hosted Wireguard setup, thank you very much.
- eviks
> Tailscale SSH now rejects usernames with leading dashes.
Is the proper fix not restricting users not possible in these poorly designed ancient systems?
Similarly re another issue: why not just fix the permission issues instead of restricting users?
> Tailscale now disallows the use of UIDs or numeric-only usernames via SSH to avoid this ambiguity
- s_ting765
I don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.
- luciana1u
tailscale ssh: replacing a 25-year-old battle-tested codebase with a startup's Go rewrite and then acting surprised when it has bugs