Tailscale, a provider of secure private networking software, has released urgent security updates after researchers disclosed vulnerabilities that could allow attackers to escalate privileges, access sensitive system resources, and disrupt network services.
The vulnerabilities were detailed in a report published Oct. 24 by security researcher Erica Windisch of Cyberdione Labs Corporation.
“We received the researcher’s report on the morning of Saturday, October 24, and the researcher published it two hours later,” Tailscale wrote in a blog post. “By that point, our engineering and security teams were already investigating several related issues and working on fixes.”
Tailscale said its engineers worked through the weekend to develop and test fixes, accelerating their response following the public disclosure.
Patches address several flaws
On Oct. 27, Tailscale released version 1.104.4 of its client software, fully addressing seven of the 11 findings detailed in Windisch’s report, according to the researcher’s updated mitigation matrix.
The patched vulnerabilities could enable SSH socket-forwarding privilege escalation, memory exhaustion that could disrupt connections, and access to privileged sockets through Tailscale Serve. In addition, one flaw is an HTTP/2 race condition that could result in unauthorized application access.
In specific circumstances, the SSH flaws could expose root-only system resources, including Docker sockets, potentially allowing attackers to gain elevated privileges and further compromise affected systems.
Tailscale said exploitation of the SSH vulnerabilities would require access to an authorized device and permission to establish SSH connections under the organization’s existing network policies.
The update does not resolve every finding in the original report, which also examined the independent headscale project and an unreleased app connector feature. Tailscale confirmed that the connector feature remains in pre-production and that its currently available stable app connectors are unaffected.
Tailscale advised organizations to upgrade to version 1.104.4 or later, review SSH access policies, and restrict unnecessary forwarding. The company also recommended adding authentication checks.
Tailscale acknowledged that the vulnerabilities exposed weaknesses in how privileges were enforced after SSH connections had been authorized.
“These privilege boundaries are an important part of Tailscale SSH’s security model, and in these cases we didn’t enforce them correctly,” the company wrote.
