Tailscale SSH is investigating security vulnerabilities affecting the SSH protocol. Engineering teams, with external specialists, identified privilege escalation issues where authorized users may perform actions beyond their configured local permissions. Most issues have been fixed, with a patched client release targeted by end of day Tuesday, October 27, 2026. Users are advised to review SSH access policies and disable forwarding via TS_SSH_DISABLE_FORWARDING=1 as a temporary mitigation. A full security advisory and technical blog post will follow the release.
The investigation builds on prior work and focuses on configurations where connecting users or device permissions allow elevated actions. Exploitation depends on specific system configurations. While not recommending a full shutdown, tightening access policies is recommended until the patch is applied. The company will publish details on confirmed vulnerabilities and impacted versions once fixes are deployed.
Source: Hacker News · Summarized by HeadlinesBriefing