Tailscale version 1.104.4 fixes SSH forwarding flaws (TS-2026-014 to TS-2026-017) where built-in SSH sessions handled network connections with root privileges, risking access to restricted files.
The update shifts forwarding execution to the logged-in user.
The issues relate to the way the system handles elevated network connections. To exploit the issues, someone would need to already control a device whose access rules allow such a connection to be opened. The service runs on Linux and open-source versions for macOS.
Research and testing
The issues were discovered by Erica Windisch of Cyberdione Labs. In tests, transferring data to the internal management mechanism led to full access and reading of sensitive system files. The researcher described the chain of issues as potentially spreading, but Tailscale rejected this characterization, referring to traffic within the network that is restricted by security rules.
The company received the report on Saturday, October 24, about two hours before it was published. So far, there are no reports that the issues have been used in actual attacks.
What users should do
Users are advised to update their software to version 1.104.4 or later. The new version performs connection transfers using the privileges of the logged-in user, not the administrator privileges.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Serious security issue in startup software for professional systems worldwide
↗
If immediate update is not possible, users can disable the connection transfer feature by setting the corresponding option in the service settings. It is noted that the alternative Headscale management service cannot disable connection transfer via rules, and version 0.29.5 does not fix these issues.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)