TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

tptacek

This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to. (If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)

e40

So, giving access via tailscale but using OpenSSH is safe, right?

kbumsik

Why own numbering instead of CVE?

cyberax

> "Tailscale SSH now rejects usernames with leading dashes." Really? That's the fix? A proper fix is to use "--" to separate arguments.

doublepg23

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.

modeless

Tailscale SSH has caused me other problems in the past because it takes over port 22. I'm not a fan.

drnick1

I'll stick to my 100% self-hosted Wireguard setup, thank you very much.

luciana1u

tailscale ssh: replacing a 25-year-old battle-tested codebase with a startup's Go rewrite and then acting surprised when it has bugs

mintflow

>>> We would like to thank Anthropic and Ada Logics for reporting this issue. it seems anthropic also use tailscale or it's just being discovered by the mythos model?

mintflow

pure logic error, the undergoing tailscale rust rewrite can't help this too:)

farfatched

Sadly, yet another path to root via Tailscale. If their scope grows, and they run so much as root, it won't be their last.