Tailscale SSH forwarding flaws let permitted sessions reach root-only sockets

Tailscale published four security bulletins on October 26, all fixed in version 1.104.4. In TS-2026-014, Tailscale SSH checked forwarding paths lexically and then performed the forwarding as root, so an authenticated peer whose access policy allowed ssh -L or ssh -R could reach root-only Unix sockets such as the Docker socket or the tailscaled local API. The Hacker News reported that a timing race let the path be swapped after the check, and that Tailscale received the report on October 24. TS-2026-016 let Serve forwards to Unix sockets dial as root, enabling full node takeover through the local API. TS-2026-015 is a memory exhaustion bug that can crash tailscaled, and TS-2026-017 let one HTTP/2 stream receive another mount's Tailscale-App-Capabilities header. Tailscale SSH servers run on Linux and the open-source macOS build.

Why it matters

Tailscale SSH replaces keys and passwords with device identity and a policy file, which makes the policy the whole authorization decision. These bugs turned "this user may open a shell as alice" into "this user may act as root", because the session's forwarding ran with the daemon's privileges rather than the user's. SSH check mode does not help, since it guards the start of a session, not what happens inside it.

Update SSH servers to 1.104.4 or later. Until then, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart. Review the SSH section of your policy so only the users and devices that need access have it, and prefer narrow device-to-device rules. If a server may already be compromised, delete the device in the admin console, since reimaging does not revoke a stolen device key. Headscale 0.29.5 does not include these fixes.

Source: Tailscale security bulletins