Skip to content
Centoculus

Security alert · High

Tailscale SSH flaws could give attackers root access: update to 1.104.4

· 2 minutes read · Centoculus Security Team

Known since

Affected: Tailscale SSH in Tailscale versions before 1.104.4

What happened

On 28 October 2026, Tailscale released version 1.104.4, which fixes several flaws in Tailscale SSH. The flaws concern how Tailscale SSH forwards connections. Because Tailscale SSH runs with root privileges, an attacker could abuse the forwarding to reach services and files on other servers that are meant to be accessible to root only.

No CVE IDs and no CVSS score are included in the information available to us, and there are no reports of active exploitation so far.

Who is affected

You are affected if you run Tailscale on servers with the Tailscale SSH feature enabled and the installed version is older than 1.104.4. Servers that use Tailscale only as a VPN connection, without Tailscale SSH, do not use the affected component. Since many teams use Tailscale SSH for administrative access to production servers, it is worth checking every node.

What to do now

  1. List the servers in your tailnet that have Tailscale SSH enabled. In the Tailscale admin console, these machines are marked as SSH-enabled; on the server itself, Tailscale SSH is enabled with tailscale set --ssh or tailscale up --ssh.
  2. Update Tailscale to version 1.104.4 or later on these servers, using your package manager (for example apt update && apt install tailscale on Debian/Ubuntu or dnf upgrade tailscale on RHEL-based systems).
  3. Restart the Tailscale daemon if the package update did not do so: systemctl restart tailscaled.
  4. Confirm that the server is back online in your tailnet with tailscale status and that you can still log in via Tailscale SSH.
  5. If you cannot update a server right away, disable Tailscale SSH there temporarily with tailscale set --ssh=false and use your regular SSH access until the update is installed.
  6. Review the SSH rules in your tailnet policy file and make sure only the users and devices that actually need Tailscale SSH access are allowed, especially for access as root.

How to check whether you are affected

  • Run tailscale version on each server. Any version below 1.104.4 is affected if Tailscale SSH is enabled.
  • Run tailscale debug prefs and look for RunSSH: true to see whether Tailscale SSH is enabled on that node.
  • To look for unusual activity, review the daemon logs with journalctl -u tailscaled for unexpected SSH sessions or connections, and check the SSH session and audit logs in the Tailscale admin console if you have them enabled. The available information does not describe specific indicators of compromise, so focus on sessions from users or devices you do not recognise.

For technical details, see the report linked below.

Sources

If you run firewalls or VPN gateways, also check

Related posts