Tailscale xavfsizlik jamoasi deyarli o'nlab xavfsizlik zaifliklarini tuzatish ustida ishlamoqda, ular orqali hujjatlarni o'g'irlash, serverlarni ishdan chiqarish, root huquqlarini qo'lga kiritish va boshqa ko'p narsalarni amalga oshirish mumkin.
Tailscale WireGuard asosida qurilgan dasturiy ta'riflangan mesh virtual xususiy tarmoq (VPN) ishlab chiqadi, bu foydalanuvchilarga kompyuterlar, serverlar va bulut instansiyalarini istalgan joydan bir xil shifrlangan mesh tarmog'iga ("tailnet") to'g'ridan-to'g'ri peer-to-peer (P2P) ulanishlar orqali ulash imkonini beradi.
Cyberdione Labs Tailscale 1.104.2 va o'z-o'zini boshqaradigan headscale v0.29.5 nazorat serverining xavfsizlik auditini o'tkazish jarayonida hali ham tuzatilmagan 11 ta kamchilikni (umumiy nomi Tailworm) aniqladi.
"Barcha topilmalar o'zgartirilmagan, chiqarilgan dasturiy ta'minot (tailscale v1.104.2, headscale v0.29.5) ustida laboratoriya muhitida qayta ishlab chiqarish orqali tasdiqlandi," dedi Cyberdione Labs asoschisi Erika Windisch, u kamchiliklarni Tailscale'ga xabar qildi va tafsilotlarni ommaviy e'lon qildi.
"Tadqiqotchilarning fikricha, bu kamchiliklar haqida tezkor xabardorlik ta'sirlangan qurilmalarda tuzatish jarayonini tezlashtiradi. Bu zaifliklar tadqiqotchilar tomonidan kiritilmagan, balki aniqlangan va juda oson aniqlangan."
Quyidagi jadval xavfsizlik muammolarini ular ta'sir qiladigan komponent bo'yicha tasniflaydi. Eng jiddiy muammo Tailscale SSH serverida bo'lib, u ruxsat etilgan hujumchilarga Unix-soket yo'naltirish orqali maqsadli tailnetdagi serverlarda root huquqlari bilan kod bajarish imkonini berishi mumkin.
| Komponent / xususiyat | Mexanizm (nima buziladi) | Hujumchi talabi | Asosiy natija |
|---|---|---|---|
| Tailscale SSH (tailscaled'ning o'rnatilgan SSH serveri, root sifatida ishlaydi) | Unix-soket yo'naltirish (ssh -R/-L) yo'l tekshiruvlari va fayl operatsiyalarini root sifatida bajaradi; poygalar va huquq pasaytirishning yo'qligi oddiy sessiyaga imtiyozli resurslarni almashtirish, ulash yoki o'chirish imkonini beradi | Bitta tasdiqlangan qurilma + bitta SSH siyosat qoidasi (yo'naltirish headscale'da avtomatik beriladi; SaaS'da har bir qoida bo'yicha) | Maqsadli serverlarda root bajarilishi; ro'yxatga olish kalitlarini qo'lga kiritish; ixtiyoriy root-fayllarni o'chirish |
| Tailscale ilova ulagichlari (conn25, eksperimental) | Ulagich trafikni hujumchi tanlagan manzillarga hech qanday tekshiruvsiz yo'naltiradi; tarmoq ACL'lari haqiqiy manzil uchun hech qachon tekshirilmaydi | Ulagich qobiliyatiga ega qurilma | Bulut metama'lumotlari (hujjat o'g'irlash), ichki LAN'lar va — Kubernetes'da — har bir klaster xizmati |
| headscale nazorat serveri (o'z-o'zini boshqaradigan o'rnatishlar) | Autentifikatsiyasiz resurs tugashi (xotira o'sishi, kesh evakuatsiyasi) | Internetga ulanish; hisob kerak emas | Nazorat serverining ishdan chiqish tsikli; yangi qurilmalarni ro'yxatga olishni butun tashkilot bo'yicha bloklash |
| Tailscale DERP mijozi (har bir agentda relay ulanishi) | Zararli relay javobini cheksiz o'qish | Mijozni dushman relayga yo'naltirish/ko'rsatish qobiliyati | Mijoz-agent xotirasining tugashi |
| tailscale serve (mahalliy xizmatni ochish) | Unix soketga TCP-yo'naltirish HTTP yo'lida mavjud bo'lgan himoyani o'z ichiga olmaydi; shuningdek, har bir montajda avtorizatsiyada poyga | Operator yo'naltirishni sozlaydi (yoki tengdosh montaj tekshiruvini poyga qiladi) | Tugunga masofaviy ma'muriy API kirishi; ilova avtorizatsiyasini chetlab o'tadigan so'rovlarning oz qismi |
Dushanba kuni Tailscale jamoasi Cyberdione Labs hisobotini olganini va bu xavfsizlik muammolarini bugun oxirigacha tuzatish uchun yamoqlar ustida ishlayotganini aytdi.
Ishlab chiquvchilar shuningdek, xabar qilingan kamchiliklar "jiddiy" ekanligini tasdiqladilar, chunki ular maqsadli tizimlarda ruxsatga ega tahdidchilarga yuqori huquqlar bilan harakat qilish imkonini berishi mumkin.
"Biz aniqlagan Tailscale SSH muammolarining aksariyati huquq oshirish bilan bog'liq. Ba'zi hollarda, Tailscale SSH orqali ulanishga ruxsat etilgan shaxs o'zining sozlangan mahalliy foydalanuvchi huquqlaridan tashqari harakatlarni amalga oshirishi mumkin, shu jumladan potentsial yuqori huquqlarni qo'lga kiritishi mumkin," dedi Tailscale.
"Bular jiddiy xavfsizlik muammolari va biz ularga shunday munosabatda bo'lamiz. Foydalanish ulanish foydalanuvchisi yoki qurilmasiga berilgan ruxsatlarga, tizimning sozlanishiga va boshqa shartlarga bog'liq. Biz topilmalarning to'liq ko'lamini va qaysi sozlanishlar ta'sirlanishi mumkinligini tekshirishni davom ettirmoqdamiz."
Biroq, muammolarning jiddiyligiga qaramay, Tailscale foydalanuvchilarga Tailscale SSH xususiyatini o'chirishni tavsiya qilmasligini aytdi.
"Agar siz eng muhim qismga o'tmoqchi bo'lsangiz, hozirgi baholashimizga ko'ra, biz hammaga Tailscale SSH'ni o'chirishni tavsiya qilmaymiz," dedi Tailscale muhandislik bo'yicha vitse-prezidenti Mike Shaver.
Buning o'rniga, Tailscale jamoasi bu kamchiliklarning ba'zilarini yumshatishi mumkin bo'lgan choralarni ulashdi:
- SSH kirish siyosatlarini ko'rib chiqing. Kirishni faqat kerak bo'lgan foydalanuvchilar va qurilmalarga cheklang.
- Agar sizga kerak bo'lmasa, SSH yo'naltirishni o'chiring. Tailscaled xizmati muhitida TSSSHDISABLE_FORWARDING=1 ni o'rnating va xizmatni qayta ishga tushiring. Bu SSH yo'naltirishni Tailscale SSH'ni butunlay o'chirmasdan o'chiradi va jiddiyroq topilmalarning bir nechtasini yumshatadi.
- Sezgir tizimlarga kirishni ko'rib chiqing. Biz tekshirishni davom ettirayotganimizda, faqat kirish kerak bo'lgan aniq foydalanuvchilar va qurilmalar ulanishi mumkin bo'lishi uchun Tailscale SSH kirish siyosatlaringizni vaqtincha qattiqlashtirishni ko'rib chiqing.
Tailscale ishlab chiquvchilari bu muammolarni tuzatuvchi yangi versiyani seshanba, 27-oktabr oxirigacha chiqarishni maqsad qilgan va foydalanuvchilardan yangilanishga tayyorlanishni va "tuzatilgan Tailscale mijoz relizini u mavjud bo'lganda qo'llashni" so'radi.
Hujumchilar haqiqiy hujjatlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hujjatlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
Tailscale develops a software-defined mesh virtual private network (VPN) built on WireGuard that lets users connect computers, servers, and cloud instances from anywhere to the same encrypted mesh network ("tailnet") via direct peer-to-peer (P2P) connections.
Cyberdione Labs discovered 11 flaws (collectively known as Tailworm) that still lack patches during a security audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server.
"All findings were verified by reproduction in a lab environment on unmodified, released software (tailscale v1.104.2, headscale v0.29.5)," said Erica Windisch, founder of Cyberdione Labs, who reported the flaws to Tailscale and publicly released the details.
"It is the opinion of the researchers that rapid awareness of these flaws will expediate remediation across impacted devices. These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort."
The table below classifies the security issues by the component they affect. The most critical issue is in Tailscale's SSH server and could let authorized attackers gain code execution with root privileges through Unix-socket forwarding on a targeted tailnet.
| Component / feature | Mechanism (what breaks) | Attacker requirement | Principal outcome |
|---|---|---|---|
| Tailscale SSH (tailscaled's embedded SSH server, running as root) | Unix-socket forwarding (ssh -R/-L) performs path checks and file operations as root; races and missing privilege drop let an ordinary session replace, dial, or delete privileged resources | One approved device + one SSH policy rule (forwarding granted automatically on headscale; per-rule on SaaS) | Root execution on target servers; capture of enrollment keys; arbitrary root-file deletion |
| Tailscale app connectors (conn25, experimental) | Connector translates traffic to attacker-chosen destinations with no validation; network ACLs are never consulted for the true destination | A device granted the connector capability | Reach cloud metadata (credential theft), internal LANs, and — in Kubernetes — every cluster service |
| headscale control server (self-hosted deployments) | Unauthenticated resource exhaustion (memory growth, cache eviction) | Internet reachability; no account | Control-server crash loop; blocking of new-device onboarding org-wide |
| Tailscale DERP client (relay connection in every agent) | Unbounded read of a malicious relay's response | Ability to position/point a client at a hostile relay | Client-agent memory exhaustion |
| tailscale serve (local service exposure) | TCP-forward to a unix socket lacks a guard present on the HTTP path; plus a race in per-mount authorization | Operator configures the forward (or a peer races the mount check) | Remote administrative-API access to the node; minority of requests bypass app authz |
On Monday, the Tailscale team said it received Cyberdione Labs' report and was working on patches to address these security issues by the end of today.
The developers also confirmed that the reported flaws are "serious" as they could let threat actors with permissions on targeted systems take actions with escalated privileges.
"Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges," Tailscale said.
"These are serious security issues, and we're treating them accordingly. Exploitation depends on the permissions granted to the connecting user or device, the system's configuration, and other conditions. We're continuing to verify the full scope of the findings and which configurations may be affected."
However, despite the severity of the issues, Tailscale said it doesn't recommend that users disable the Tailscale SSH feature.
"If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH," saidMike Shaver, VP of Engineering at Tailscale.
Instead, the Tailscale team shared measures that should mitigate some of these flaws:
- Review SSH access policies. Limit access to the users and devices that need it.
- Disable SSH forwarding if you don't need it. Set TSSSHDISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This disables SSH forwarding without disabling Tailscale SSH entirely, and mitigates several of the more serious findings.
- Review access to sensitive systems. Consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
The Tailscale devs aim to push a new version that fixes these issues by the end of Tuesday, October 27, and urged users to prepare to update and "apply the patched Tailscale client release when it becomes available."
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report