Tailscale released version 1.104.4 with fixes for Tailscale SSH vulnerabilities described in the 'Tailworm' report, published on 24 October. The problems concerned how permissions were enforced after a connection was authorised, so that a session could, under certain conditions, act beyond the local user's rights, including through SSH forwarding. Exploitation requires existing access to an authorised device on the network and a policy that allows SSH. The company published four security bulletins, TS-2026-014 to TS-2026-017, and also fixed three bugs in Serve and Funnel.

What it means: Tailscale is widely used by small companies, development teams and system administrators for secure remote access without a classic VPN, so a flaw in its built-in SSH affects many systems in Greece too. The reassuring part is that the flaws do not let a stranger connect from outside: a device inside the network must already be compromised, and movement is limited to machines the access policy allows. The worrying part is that, in that case, a user with a restricted account could gain administrator rights on the server, exactly the kind of lateral movement ransomware attacks rely on. The case also shows that publishing the report a few hours after notifying the company left users without a fix for several days. For anyone using Tailscale SSH, the first step is to update every node to 1.104.4 or later. After that, review the access policy so SSH is allowed only for the users and devices that need it, and turn on check mode, which asks for extra identity confirmation, for sensitive servers.

Read the original on Tailscale

Related service: Custom software

Related stories