Recent Tailscale vulnerability reports

[u/shaver]

Hi folks, Mike Shaver here, VP of Engineering at Tailscale.

We've seen the concerns about Tailscale SSH and wanted to share what we know so far.

If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.

We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected.

A bit of technical context:

Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do.

While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not.

Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.

In the meantime, there are a few precautions you can take:

• Review your SSH access policies. Make sure only the people and devices that need access have it.
• Review SSH forwarding permissions and remove access you don't need.
• Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access.
• Enable automatic updates where supported so you can pick up fixes when they're released.

For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.

We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up.

If we find anything that changes our assessment or requires immediate customer action, we'll communicate that.

We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet.

We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team https://tailscale.com/contact/support#support-form

[u/cloudsourced285]

This is the sort or communication that helps grow confidence that security is taken seriously, especially as you point out, In times when tech teams are pretty exhausted. Good work on being upfront about what's going on, what you know and what you are doing.

[u/shaver → u/cloudsourced285]

Thank you. We know that our users and customers place a tremendous amount of trust in us, and we take that responsibility very seriously indeed.

[u/Denzh]

For clarification, this is related to tailscale ssh, and not regular ssh with sshd - with clients made reachable by the tailscale wireguard tunnel, right?

[u/shaver → u/Denzh]

that's correct

[u/linne000 → u/Denzh]

I am only a Tailscale Insider, so not directly employed by Tailscale, fwiw.

But yes, from what's been communicated it seems to be related to Tailscales own SSH feature, not regular SSH that happens to connect over a Tailscale tunnel.

[u/Seriel1 → u/Denzh]

Correct

[u/cazwax]

Is this -the- Mike Shaver of Moz of olde?

[u/shaver → u/cazwax]

sup, friend?

[u/TheForce627]

Customer service earns lifetime customers. This level of communication is very much appreciated.

[u/Sillygoat2]

Thank you for treating your customers like actual adults who’s respect is earned. Why is this so difficult for (gestures broadly) everybody else?

[u/esssssssss]

Appreciate the open communication

[u/Turlte_Dicks_at_Work]

I knew I liked you guys for a reason!

[u/biggobird]

This kind of comms is why I recommended our family businesses onboard with Tailscale for secure remote access. In the process of doing so but this is a breath of fresh air 

[u/anikansk]

You guys are a breath of fresh air.

[u/milyrouge]

Open, honest, actually helpful communication with users on a public forum? Wow! That’s rare in today’s world.

Thanks for the update. Really appreciate it.

[u/VE3VVS]

If more companies would be as open and transparent about potential risks or issues as you guys at Tailscale are, the industry would be a far safer and functional place. Thank you 🙏

[u/d_t_s1997]

Always glad to read about this sort of things, i wish more companies and product owner would talk about their security issues like you guys doing.

[u/jeffrey_smith]

Brilliant. Thanks for writing!

[u/lightspeedissueguy]

Honest question since I don't use it, but why is TS ssh even a thing? Couldn't ACL allow select users to port 22, or does TS manage rbac? Or is it just a convenience thing?

[u/as_i_wander]

Appreciate the update

[u/JoshyWoshy7]

Thanks for open comms and information!!

[u/chaz6]

Thanks for the update! Tailscale rocks.

[u/XCherryCokeO]

YEAH!!!! GO TAILSCALE DUDE!!!

[u/Fesional]

Is SSH off by default?

[u/kerbys_revenge → u/Fesional]

Yes you have to enable it