If you use Tailscale SSH on your servers, update Tailscale this week

If you use Tailscale to get into your servers, and you've switched on Tailscale SSH, there's an update to install this week. Tailscale has fixed several flaws that could let someone who's already allowed in do more than they should, up to and including root.

If you only use Tailscale as a private network and log in with ordinary SSH over the top, most of this doesn't apply to you. Update anyway. It's a two minute job.

What happened

On 26 October Tailscale published an investigation update about what it called "serious security issues" in Tailscale SSH. Most of them are about privilege escalation. A user who is already allowed to connect over Tailscale SSH may be able to go beyond the permissions of the local user they log in as.

The same day it added four bulletins to its security bulletins page. The ones that matter most for a small business server are:

• TS-2026-014. If your access policy allows SSH port forwarding, a peer could reach sockets that only root should be able to use, such as the Docker socket or Tailscale's own control socket. Those sockets are locked to root for a reason.
• TS-2026-015. A peer with an SSH session could make Tailscale use more and more memory until it crashed, taking all of that server's Tailscale connections down with it.
• TS-2026-016. If you use tailscale serve to point at a Unix socket, it could be used to reach privileged sockets, including that same control socket. Tailscale says this "allowed full node takeover".

There's a fourth, TS-2026-017, which only affects people using Serve with TLS and more than one mount.

All four are fixed in Tailscale 1.104.4 or newer. That version is now the current stable release in Tailscale's package repository and on GitHub.

Does it affect you?

The important word in all of this is "authorised". None of these let a stranger on the internet walk in. The attacker has to be a person or device that your Tailscale policy already lets connect. That might sound like a small risk, but think about who's on your tailnet: staff laptops, an old phone, a contractor you gave access to last year. If any one of those gets compromised, flaws like these could help an attacker get from that device to root on your server.

Tailscale SSH is switched off unless someone turned it on. To find out on a Linux server, run:

tailscale debug prefs | grep RunSSH

If it says true, Tailscale SSH is on. If it says false, the SSH flaws don't apply, though you should still update.

To see which version you're running:

tailscale version

Anything below 1.104.4 needs updating.

What to do this week

1. Update every server. On most Linux servers this works:

sudo tailscale update

If it doesn't work on your distribution, use the package manager. On Debian or Ubuntu that's sudo apt-get update then sudo apt-get install tailscale. Tailscale's update guide lists the others. Run tailscale version again afterwards to check it took.

2. Don't wait for auto-update. If you've switched on auto-updates, that's good, but Tailscale's own guide says they "do not happen immediately" after a release. For a security fix I'd do it by hand.

3. Check the admin console. The Machines page shows a version for every device on your tailnet, with a red arrow next to anything that needs a security update. It's the quickest way to spot the server you forgot about.

4. Turn off SSH forwarding if you don't use it. Tailscale's advice, as a stopgap and for anything you can't update straight away, is to set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it. On Debian and Ubuntu that environment lives in /etc/default/tailscaled. Add the line, then:

sudo systemctl restart tailscaled

Be aware that this breaks anything that tunnels through Tailscale SSH, such as a database tunnel or editing files remotely from your code editor. If nobody uses those, you won't miss it.

5. Tidy up who can get in. Tailscale also suggests reviewing your SSH access rules and limiting them to the people and devices that really need them. While you're there, remove anyone who has left, and any device nobody recognises.

It may not be over

Tailscale says some findings are still under review, and it plans a fuller write-up. So it's worth keeping an eye on the bulletins page over the next week or two, in case there's a second round.

The bigger point

I recommend Tailscale. I suggested it in my post on learning Linux and hosting your own stuff, and I'd still suggest it today. Keeping your server off the open internet is a big step up from opening ports on your router.

But a tool that guards the door needs updating like everything else on the server. It's easy to install Tailscale once and forget it's there, because it just works. If you'd rather somebody else kept track of updates like this one across all your servers, that's what my support retainers are for.