Tailscale has released update v1.104.4, which addresses 4 vulnerabilities, including the Tailscale SSH vulnerability reported in the Tailworm report by Cyberdione Labs.

Key summary

The security company Tailscale has released version 1.104.4 to address four security vulnerabilities, including a fix for a vulnerability in Tailscale SSH that was disclosed in a report called "Tailworm" from Cyberdione Labs. This vulnerability allowed attackers who controlled one device in the tailnet to escalate privileges and access other machines on the same network if the tailnet file policy allowed it. Attackers could also steal keys used to register new devices in order to introduce rogue devices into the Tailscale network. Tailscale does not consider this vulnerability to be a worm because attackers can only access machines that the SSH policy allows. The report also identified a vulnerability in Conn25, an app connector feature that is in the pre-production phase, and a Denial-of-Service issue that could cause self-hosted control servers to stop working. Tailscale has fixed all of these vulnerabilities in version v1.104.4. Administrators should update immediately and review SSH access policies for critical systems. It is recommended to enable Check mode for Tailscale SSH to add an additional authentication step before accessing machines.