{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tailscale-serve--1.104.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tailscale client (\u003c= 1.104.2)","headscale (\u003c= 0.29.5)","Tailscale (\u003c 1.104.4)","headscale","Tailscale (\u003c= 1.104.2)","Tailscale (\u003c= 1.104.3)","Tailscale SSH (\u003c= 1.104.2)","Tailscale serve (\u003c= 1.104.2)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","lateral-movement","network-security","tailscale"],"_cs_type":"advisory","_cs_vendors":["Tailscale"],"content_html":"\u003cp\u003eTailscale has released version 1.104.4 to address four security bulletins (TS-2026-014, TS-2026-015, TS-2026-016, and TS-2026-017) affecting its built-in SSH server. The primary vulnerability involves a timing-based socket-forwarding flaw where an attacker with existing network access can perform a socket-swap, allowing them to interact with root-privileged Unix sockets such as the Docker control socket or the tailscaled local API. Additional vulnerabilities include a denial-of-service vector via memory exhaustion, unauthorized local API access in tailscale serve, and potential permission header leakage. These flaws do not allow for unauthenticated access, requiring an attacker to already possess a foothold on a device authorized by the network access policy. No CVE identifiers have been assigned at this time.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could allow an attacker to gain root-level access to sensitive local services on a target node. The flaws are limited by existing network access policies; attackers can only target machines that their current policy already permits them to reach.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Tailscale client installations to version 1.104.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable SSH forwarding by setting the environment variable 'TS_SSH_DISABLE_FORWARDING=1' in the tailscaled service configuration.\u003c/li\u003e\n\u003cli\u003eReview network access rules to ensure minimal privilege, as compromised devices can move laterally to any node permitted by the policy.\u003c/li\u003e\n\u003cli\u003eFor headscale users, acknowledge that SSH forwarding should be treated as root-level access until a fix is available, as the current version does not support disabling this functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T20:01:40Z","date_published":"2026-10-27T16:06:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/","summary":"Tailscale versions prior to 1.104.4 contain multiple vulnerabilities in SSH socket forwarding and service handling that could allow authenticated users to escalate privileges to root on targeted nodes.","title":"Tailscale: Privilege escalation and security flaws in SSH server","url":"https://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/"}],"language":"en","title":"CraftedSignal Threat Feed - Tailscale Serve (\u003c= 1.104.2)","version":"https://jsonfeed.org/version/1.1"}