Researchers disclose 11 unpatched Tailscale flaws; fixes underway
Summary
Cyberdione Labs disclosed 11 flaws in Tailscale and headscale, including issues that could enable root-level actions or service disruption. Tailscale is preparing fixes and recommends reviewing SSH access and disabling forwarding if unnecessary.
Key points
- Cyberdione Labs said it reproduced 11 flaws in Tailscale 1.104.2 and headscale v0.29.5; the issues were publicly disclosed and were still unpatched at the time of reporting.
- A Tailscale SSH flaw involving Unix-socket forwarding could let an authorized user exceed local permissions, potentially gaining root access or deleting privileged files.
- Other findings include app-connector access to unintended destinations, resource exhaustion affecting headscale, and memory exhaustion in clients connected to a hostile DERP relay.
- Tailscale said exploitation depends on permissions, system configuration, and other conditions, and that it was still assessing the full scope.
- Tailscale advised reviewing SSH policies and disabling SSH forwarding when unnecessary with TS_SSH_DISABLE_FORWARDING=1; it did not recommend disabling Tailscale SSH for everyone.
- Tailscale said it was working on patches and urged users to apply the updated client release when available.
Article Details
- Vulnerability Types
- Root privilege escalation
- Code execution through Unix-socket forwarding
- Path-check and race-condition flaws
- Network access-control bypass
- Unauthenticated resource exhaustion
- Memory exhaustion from an unbounded relay response
- Authorization-check race condition
- Severity
- Described as serious; one issue could enable root-level code execution.
- Affected Versions
- Tailscale 1.104.2
- headscale v0.29.5
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service; this mitigates several serious findings.
- Review SSH access policies and limit access to the users and devices that need it.
- Temporarily tighten SSH access policies for sensitive systems.