Tailscale SSH: Findings and fixes
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Tailscale disclosed fixes for vulnerabilities in Tailscale SSH and related features, reported in a researcher's "Tailworm" report, and shipped them in v1.104.4. The flaws let an already-authorized peer exceed its assigned privileges after connecting, including via SSH forwarding, but could not be used by unauthenticated attackers.