Tailscale races patches after researcher publishes unpatched Tailworm SSH flaws
The gist
Security firm Cyberdione Labs published 11 Tailscale SSH findings on Oct 25, before any patch existed.
Tailscale says most fixes are in; users should watch for the patched client.
How it unfolded
- Jun 3, 2026Bulletins TS-2026-004 (SSH) and TS-2026-005 (Serve) covered earlier Unix socket flaws in these areas and named version 1.98.9 as the fix.
- Jul 2026Tailscale fixed TS-2026-009, where a username beginning with a dash could make a Linux account lookup return the root account; the fix arrived in version 1.98.9.
- Oct 22, 2026 -24, 2026Cyberdione Labs ran the lab testing that preceded its report.