Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

OttoWood

Tailscale SSH does not work like a normal SSH server. Rather than checking a connecting user's password or key, it identifies the device, and a single access rule decides whether that device may open an SSH session to a target.

Because of this, the attack needs no stolen passwords or keys.

https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html

ScreenReader

this is the most unorganic "vpn" software i've seen so far, the astroturfing on self-hosted community both on reddit or orange reddit are something else. I have no idea why would anyone use this thing to manage their ssh access (adding attack vector) instead of disabling it, use your sshd that you already put your keys on and you can access them using your private tailscale IP anyway.

it's only called a "flaw" because it got caught.

op23

@ScreenReader said:
this is the most unorganic "vpn" software i've seen so far, the astroturfing on self-hosted community both on reddit or orange reddit are something else. I have no idea why would anyone use this thing to manage their ssh access (adding attack vector) instead of disabling it, use your sshd that you already put your keys on and you can access them using your private tailscale IP anyway.

it's only called a "flaw" because it got caught.

It’s user friendly, and so easy that in a little bit of setup I was able to run my iPhone app with a gRPC backend on same tunnel with least headache.

Hope they patch this soon, the OP could have also mentioned that the attack requires access to at least another device using Tailscale and it requires port forwarding which is not default afaik.

OttoWood

@ScreenReader said:
orange reddit

What is orange Reddit?

use your sshd

I 100% agree.

@op23 said:
the OP could have also mentioned that the attack requires access to at least another device using Tailscale

The title of this thread specifically mentions it needs a compromised device.

and it requires port forwarding which is not default afaik.

I don't use Tailscale at all, so can't confirm this. The source code checks whether AllowLocalPortForwarding and AllowRemotePortForwarding are set to true when activating the SSH function. The source code doesn't indicate default behaviour; BUT runtime dumps from bug reports suggest it might be on by default (take this info with a grain of salt). As the article mentions, if you use headscale then it's always on.

op23

@OttoWood said:

@ScreenReader said:
orange reddit

What is orange Reddit?

use your sshd

I 100% agree.

@op23 said:
the OP could have also mentioned that the attack requires access to at least another device using Tailscale

The title of this thread specifically mentions it needs a compromised device.

and it requires port forwarding which is not default afaik.

I don't use Tailscale at all, so can't confirm this. The source code checks whether AllowLocalPortForwarding and AllowRemotePortForwarding are set to true when activating the SSH function. The source code doesn't indicate default behaviour; BUT source dumps from bug reports suggest it might be on by default (take this info with a grain of salt). As the article mentions, if you use headscale then it's always on.

Sorry my bad, yes you did mention in title.

Checked the config on my PC and the flags are set to false. So that’s a plus at least.

May be I will finally just go towards plain wire guard tinkering to enable what I need, but Tailscale is too damn nice lol.

ScreenReader

@OttoWood said:

@ScreenReader said:
orange reddit

What is orange Reddit?

news.ycombinator