{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/tsdproxy/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["tsdproxy \u003c 1.4.4-0.20260603142855-434819b4421e"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","privilege-escalation","authentication-bypass","tsdproxy","go"],"_cs_type":"advisory","_cs_vendors":["almeidapaulopt"],"content_html":"\u003cp\u003eA critical vulnerability (GHSA-g936-7jqj-mwv8) has been identified in TSDProxy, a Tailscale proxy service. This vulnerability arises because TSDProxy, by default, forwards its internal per-process authentication token (\u003ccode\u003ex-tsdproxy-auth-token\u003c/code\u003e) to all proxied backend services when the \u003ccode\u003eidentityHeaders\u003c/code\u003e feature is enabled. This token is crucial for the management HTTP server to trust forwarded Tailscale identity claims. An attacker who has achieved code execution on a backend service co-located on the same host or within the same network namespace as TSDProxy can capture this token. By replaying the stolen token, along with a crafted \u003ccode\u003ex-tsdproxy-id\u003c/code\u003e header, to TSDProxy's local management API (typically on \u003ccode\u003e127.0.0.1:8080\u003c/code\u003e), the attacker can bypass authentication entirely. This grants them full control over the TSDProxy management API, enabling a range of malicious actions, including service disruption and sensitive information exposure. The vulnerability affects \u003ccode\u003ego/github.com/almeidapaulopt/tsdproxy\u003c/code\u003e versions prior to \u003ccode\u003e1.4.4-0.20260603142855-434819b4421e\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eTSDProxy is deployed with the \u003ccode\u003eidentityHeaders\u003c/code\u003e configuration enabled (this is the default setting).\u003c/li\u003e\n\u003cli\u003eA backend service is deployed on the same host as TSDProxy, within a Docker container in host-network-mode, or in a container sharing TSDProxy's network namespace.\u003c/li\u003e\n\u003cli\u003eAn attacker successfully gains code execution on the co-located backend service.\u003c/li\u003e\n\u003cli\u003eAs TSDProxy forwards requests to the compromised backend, it unconditionally injects its internal \u003ccode\u003ex-tsdproxy-auth-token\u003c/code\u003e into the HTTP request headers.\u003c/li\u003e\n\u003cli\u003eThe attacker, having control of the backend, captures the \u003ccode\u003ex-tsdproxy-auth-token\u003c/code\u003e from the incoming HTTP request headers.\u003c/li\u003e\n\u003cli\u003eFrom the compromised backend, the attacker crafts and executes an HTTP request (e.g., using \u003ccode\u003ecurl\u003c/code\u003e) to the TSDProxy management API at \u003ccode\u003e127.0.0.1:8080\u003c/code\u003e. This request includes the stolen \u003ccode\u003ex-tsdproxy-auth-token\u003c/code\u003e and an arbitrary \u003ccode\u003ex-tsdproxy-id\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eTSDProxy's management API, designed to trust requests from localhost with a valid \u003ccode\u003ex-tsdproxy-auth-token\u003c/code\u003e, grants the attacker full administrative control without requiring proper Tailscale authentication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to full compromise of the TSDProxy management API. An attacker can leverage this access to perform various damaging actions, including restarting or pausing all proxied services, effectively causing a Denial of Service (DoS) condition. They can also enumerate all proxy configurations, exposing sensitive details about the backend network topology and service configurations. Furthermore, the attacker can trigger webhook deliveries configured within TSDProxy, potentially leading to Server-Side Request Forgery (SSRF) if webhook URLs are external or sensitive.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003ego/github.com/almeidapaulopt/tsdproxy\u003c/code\u003e to version \u003ccode\u003e1.4.4-0.20260603142855-434819b4421e\u003c/code\u003e or newer immediately, as outlined in the GitHub Advisory GHSA-g936-7jqj-mwv8.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect TSDProxy Management API Authentication Bypass Attempt\u0026quot; to your SIEM solution to detect suspicious process creations attempting to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement network monitoring for outbound HTTP connections originating from backend processes and destined for \u003ccode\u003e127.0.0.1:8080\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBlock connections to \u003ccode\u003e127.0.0.1:8080\u003c/code\u003e from untrusted or non-whitelisted processes if possible, to mitigate unauthorized access to the TSDProxy management API.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-10T21:45:07Z","date_published":"2026-07-10T21:45:07Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tsdproxy-auth-token-escalation/","summary":"A critical vulnerability in TSDProxy allows its internal per-process authentication token to be unconditionally forwarded to proxied backend services when `identityHeaders` is enabled, enabling an attacker with code execution on a co-located backend to replay the token to the local TSDProxy management API (port 8080) and bypass authentication, leading to full management API control.","title":"TSDProxy Internal Authentication Token Vulnerability Leading to Management API Escalation","url":"https://feed.craftedsignal.io/briefs/2026-07-tsdproxy-auth-token-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Tsdproxy","version":"https://jsonfeed.org/version/1.1"}