Tailscale finds privilege escalation flaws in Tailscale SSH, patch due Tuesday

Tailscale SSH: Investigation and remediation update

Tailscale is investigating privilege escalation vulnerabilities in Tailscale SSH that could let an already-authorized user act beyond their configured local permissions, potentially gaining elevated privileges. Exploitation depends on granted permissions and system configuration. Fixes for most issues are implemented, with a patched client targeted for Tuesday, October 27. Tailscale is not recommending everyone disable Tailscale SSH, but advises reviewing access policies and setting TS_SSH_DISABLE_FORWARDING=1 to mitigate several serious findings.