Last weekend, a security researcher published a report titled “Tailworm,” describing potential vulnerabilities in Tailscale SSH and other Tailscale features.
We know that people rely on Tailscale to protect access to important systems, and we understand how concerning it is to learn that some of those protections didn’t work as intended.
Over the past several days, our engineering and security teams have identified issues that require urgent attention, reviewed related code, and developed and tested fixes. Beyond addressing the individual vulnerabilities, we’ve also introduced architectural safeguards designed to protect against broader classes of related issues.
Those fixes are now available in Tailscale v1.104.4.
We know that earning your trust means more than simply releasing a patch. You deserve to understand what happened, how it might have affected you, and what we’ve done to make things better. That’s what we want to explain here.
A little background on Tailscale SSH
Tailscale supports standard SSH connections over your tailnet, including OpenSSH. Tailscale SSH goes further by providing a built-in SSH server that uses Tailscale identities and access policies to control access.
Administrators…