Tailscale fixes vulnerabilities in SSH and HTTP request handling to prevent unauthorized access and denial of service attacks.
On July 13, 2026, Tailscale released important microsoft-extends-free-windows-10-security-updates-for-another-year/">security updates to address vulnerabilities that could potentially allow attackers to gain unauthorized root access or disrupt service operations. The two significant issues identified in this release, described in TS-2026-008 and TS-2026-009, urged users to update to version 1.98.9 or newer to safeguard their systems.
One major issue involved insecure command line argument handling in Tailscale SSH. Previously, usernames with a leading dash (-) were accepted, which was particularly problematic for Linux users. When such usernames were supplied, they were treated as flags by the getent command used to retrieve the corresponding password entry.
This could lead to critical security breaches. For instance, if an attacker connected with the username -i, the system interpreted this as the --no-idn flag. Consequently, getent would expose the complete password file, starting from the root user, effectively granting interactive root access to the attacker. This violation of Access Control Lists (ACLs) posed a significant risk, especially for users reliant on non-root user restrictions.
Recognizing this flaw, Tailscale implemented a fix in their latest release, which now rejects usernames that begin with a dash. This adjustment aims to strictly enforce security measures and prevent unauthorized root access.
The second issue detailed in the security report involved a denial of service vulnerability triggered by a malformed HTTP request. Nodes equipped with Tailscale Serve or Tailscale Funnel could be easily exploited by an attacker sending a specially crafted HTTP request that led to indefinite CPU consumption.
This denial of service attack occurred because Tailscale Walk attempted to resolve the path for the incoming request upwards one directory at a time. If the request path did not start with a slash (/), the server could enter an infinite loop, ultimately pinning a CPU core indefinitely. Since there were no enforced request timeouts, this situation resulted in a persistent 100% CPU usage for as long as the process was active.
The mitigation measures included modifying the server's behavior to terminate the path walk immediately for requests that do not start with an absolute path. By doing so, the server automatically returns no handler and closes the request, eliminating the risk of CPU core exhaustion.
Users of Tailscale are strongly advised to upgrade to version 1.98.9 or later to ensure their systems are secure from these vulnerabilities. This update is crucial for those running Tailscale Serve or Tailscale Funnel, as the previous versions were susceptible to attacks from internal and external threats.
For Tailscale SSH users, particularly on Linux systems, it is also imperative to apply the latest updates to maintain effective ACL protection and prevent unauthorized root access.
Tailscale has expressed gratitude to Anthropic and Ada Logics for reporting these critical security issues. These reports have prompted the necessary fixes that protect users from potential attacks.
As vulnerabilities continue to emerge in various software systems, staying informed about updates and promptly applying them is essential for maintaining a secure digital environment.