Tailscale says most of its SSH bugs are privilege escalations, and a patch was due October 27

What Tailscale has said so far

In its investigation update, published October 26, Tailscale says most issues concern privilege escalation: someone already authorized to connect over Tailscale SSH may be able to act beyond their configured local user, including gaining elevated privileges. Exploitation depends on permissions, configuration and other conditions, and the full scope is still being verified.

Fixes exist for most findings and are being tested before a patched client, targeted for October 27 subject to testing. Until then it recommends tightening SSH access policies and, if forwarding is not needed, setting TS_SSH_DISABLE_FORWARDING=1 and restarting the service. A security advisory and a technical post will follow.

Who is actually exposed

A former Tailscale employee who now manages it at an organization reviewed the fixes as they landed on GitHub and wrote:

"this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root."

A skeptical reader questioned the wording of "most" issues and "in some circumstances", suggesting a fully unauthorized connection could also be under investigation. Another said the product has too many features, and wants a lockdown mode without Taildrop, Taildrive, SSH and funnel.

A homelab owner said he moved to plain WireGuard because he used none of the extras.

If your ACLs grant Tailscale SSH to people who should not be root, set the forwarding variable now and watch for the advisory.