Researcher publishes 11 unpatched Tailscale flaws, skipping coordinated disclosure

Security researcher Erica Windisch bypassed coordinated disclosure and published 11 unpatched Tailscale vulnerabilities. In her testing, race conditions in Tailscale SSH allowed a compromised device to obtain root on other servers and add a rogue node to the network. Tailscale's VP of Engineering, Mike Shaver, said the company has received the report and is reviewing it with external security specialists. He said most identified issues involve post-authorization handling of Unix privileges and SSH forwarding, and that Tailscale is not recommending everyone disable Tailscale SSH, while advising users to review access policies and enable SSH check mode pending fixes and a security advisory.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Security