Tailscale patches SSH flaws that let an already-trusted device reach root-only services on a server
Tailscale's investigation page and The Hacker News explain who is exposed and the one setting that blocks the worst of it.
Tailscale, a popular VPN-style networking service, released client version 1.104.4 to fix four security bulletins in Tailscale SSH and related features, after a researcher, Erica Windisch of Cyberdione Labs, published a report called Tailworm, The Hacker News reports.
The main flaw was in socket forwarding: the server checked a path and then acted as root, and a timing trick could swap the path in between. An attacker who already controls a device allowed to open SSH sessions could reach root-only sockets such as Docker's, which in Windisch's tests gave a root shell. Tailscale says the flaws do not let an unauthenticated attacker connect to arbitrary servers. The fix runs forwarding as the logged-in user.
Tailscale recommends updating, tightening SSH access rules, and, where an update must wait, setting TS_SSH_DISABLE_FORWARDING=1, which it says blocks several of the more serious findings without turning off Tailscale SSH.