Tailscale (< 1.104.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tailscale--1.104.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 16:06:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTailscale: Privilege escalation and security flaws in SSH serverhttps://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/Tue, 27 Oct 2026 16:06:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/Tailscale versions prior to 1.104.4 contain multiple vulnerabilities in SSH socket forwarding and service handling that could allow authenticated users to escalate privileges to root on targeted nodes.Tailscale has released version 1.104.4 to address four security bulletins (TS-2026-014, TS-2026-015, TS-2026-016, and TS-2026-017) affecting its built-in SSH server. The primary vulnerability involves a timing-based socket-forwarding flaw where an attacker with existing network access can perform a socket-swap, allowing them to interact with root-privileged Unix sockets such as the Docker control socket or the tailscaled local API. Additional vulnerabilities include a denial-of-service vector via memory exhaustion, unauthorized local API access in tailscale serve, and potential permission header leakage. These flaws do not allow for unauthenticated access, requiring an attacker to already possess a foothold on a device authorized by the network access policy. No CVE identifiers have been assigned at this time.

Impact

Successful exploitation could allow an attacker to gain root-level access to sensitive local services on a target node. The flaws are limited by existing network access policies; attackers can only target machines that their current policy already permits them to reach.

Recommendation

  • Update all Tailscale client installations to version 1.104.4 or later immediately.
  • If immediate patching is not possible, disable SSH forwarding by setting the environment variable 'TS_SSH_DISABLE_FORWARDING=1' in the tailscaled service configuration.
  • Review network access rules to ensure minimal privilege, as compromised devices can move laterally to any node permitted by the policy.
  • For headscale users, acknowledge that SSH forwarding should be treated as root-level access until a fix is available, as the current version does not support disabling this functionality.
]]>highadvisoryprivilege-escalationlateral-movementnetwork-securitytailscale