Affected Systems
Tailscale v1.104.2 and earlier, headscale v0.29.5 and earlier (self-hosted control server). Affects Tailscale SSH, app connectors, DERP relay client, headscale control server, and tailscale serve features. All deployments using Tailscale SSH are potentially impacted.
Exploitation Status
No active exploitation reported. Vulnerabilities publicly disclosed by Cyberdione Labs with reproduction details. Researchers state flaws were discovered "with low effort," increasing likelihood of exploitation. No CVEs assigned yet.
Business Impact
Authorized attackers with SSH access can escalate to root via Unix-socket forwarding races. App connector feature allows credential theft from cloud metadata services and bypasses network ACLs. Unauthenticated attackers can crash self-hosted headscale servers, blocking org-wide device onboarding. Exploitation requires existing device authorization or SSH policy rules, limiting immediate risk to environments with permissive Tailscale SSH configurations.
Urgency
🟠Within 24 hours
Recommended Actions
- Prepare to deploy Tailscale client patches immediately when released (expected EOD October 27, 2026)
- Set TS_SSH_DISABLE_FORWARDING=1 in tailscaled service environment and restart to disable SSH forwarding while maintaining SSH access
- Review and tighten Tailscale SSH access policies to limit connections to only required users and devices
- Audit app connector usage and disable experimental conn25 feature if not operationally required
- For self-hosted headscale deployments, restrict control server exposure to trusted networks until patches available