English
English 日本語
Get a fix plan
Menu

Projects

Apache HTTP ServerApache Log4jnginxNode.jsOpenSSLPHPApache TomcatWordPressAll projectsStatusAlerts (soon)Method Get a fix plan
Data checked 17 open events tracked Official sources only

Tailscale SSH security fixes: what was fixed and how to check your nodes

Tailscale's client release fixes two bulletins about Tailscale SSH: Unix socket forwarding and memory use in session handling. The same release also fixes two Tailscale Serve bulletins. Every statement below links to Tailscale's own page, with the quoted text one click away. The bulletins give the fixed release and no list of affected releases, so the check below compares your version with the fixed one.

Facts last checked against the stored sources on

The release

  • Tailscale's changelog lists client release 1.104.4 on . For each fix below it points to the matching security bulletin.

    Source: Tailscale changelog

    Quoted text
    Oct 28, 2026 Tailscale v1.104.4 Update instructions

Tailscale SSH: Unix socket forwarding

  • Bulletin TS-2026-014: Tailscale SSH Unix socket forwarding could grant peers access to root-only sockets. Tailscale says an attacker could reach root-only sockets such as the Docker socket or the tailscaled local API.

    Source: Tailscale security bulletins

    Quoted text
    TS-2026-014 Description : Tailscale SSH Unix socket forwarding could grant peers access to root-only sockets.
    What was the impact? An attacker could reach root-only sockets such as the Docker socket or the tailscaled local API.

  • Tailscale states which nodes are affected: those with Tailscale SSH enabled that also allow local or remote forwarding in their access policies.

    Source: Tailscale security bulletins

    Quoted text
    Who was affected? This issue affects users with Tailscale SSH enabled who also allow local or remote forwarding in their access policies.

  • Tailscale now performs Unix socket forwarding on behalf of the authenticated user rather than as root. The bulletin says the vulnerability is fixed in Tailscale version 1.104.4 or newer.

    Source: Tailscale security bulletins

    Quoted text
    Tailscale now performs Unix socket forwarding on behalf of the authenticated user rather than as root. This vulnerability is fixed in Tailscale version 1.104.4 or newer.

  • As a mitigation, Tailscale says you can disable SSH forwarding by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. This disables forwarding without disabling all of Tailscale SSH.

    Source: Tailscale security bulletins

    Quoted text
    As a mitigation, you can disable SSH forwarding by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. This disables forwarding without disabling all of Tailscale SSH.

Tailscale SSH: memory use in session handling

  • Bulletin TS-2026-015: memory exhaustion in Tailscale SSH session handling could lead to denial of service. Tailscale says the memory could run out and the tailscaled process be killed, which disrupts every Tailscale connection on the node.

    Source: Tailscale security bulletins

    Quoted text
    TS-2026-015 Description : Memory exhaustion in Tailscale SSH session handling could lead to denial of service.
    What was the impact? An attacker could exhaust available memory on the host, leading to an out-of-memory (OOM) kill of the tailscaled process. Because tailscaled is central to all node networking state, such a crash disrupts every Tailscale connection on the node.

  • Tailscale states that the issue affects nodes running the Tailscale SSH server, and that an authenticated SSH session permitted by policy is required to trigger it.

    Source: Tailscale security bulletins

    Quoted text
    Who was affected? This issue affects nodes running the Tailscale SSH server. An authenticated SSH session permitted by policy is required to trigger the condition.

  • Tailscale now bounds the memory used for session handling and releases it when the peer disconnects. The bulletin says the vulnerability is fixed in Tailscale version 1.104.4 or newer.

    Source: Tailscale security bulletins

    Quoted text
    Tailscale now bounds the memory used for session handling and releases it when the peer disconnects. This vulnerability is fixed in Tailscale version 1.104.4 or newer.

Same release: Tailscale Serve

These two bulletins are not about Tailscale SSH. They are listed because the same client release fixes them.

  • Bulletin TS-2026-016: tailscale serve Unix backends could reach privileged sockets, including the tailscaled local API socket. Tailscale says: if you use Tailscale Serve with Unix socket backends, upgrade to version 1.104.4 or newer.

    Source: Tailscale security bulletins

    Quoted text
    TS-2026-016 Description : tailscale serve Unix backends could reach privileged sockets, including the tailscaled local API socket.
    What do I need to do? If you use Tailscale Serve with Unix socket backends, upgrade to Tailscale version 1.104.4 or newer.

  • Bulletin TS-2026-017: the HTTP/2 shared serve context could send the wrong Tailscale-App-Capabilities values across mounts. Tailscale says: if you use Tailscale Serve with TLS enabled, upgrade to version 1.104.4 or newer.

    Source: Tailscale security bulletins

    Quoted text
    TS-2026-017 Description : HTTP/2 shared serve context could send the wrong Tailscale-App-Capabilities values across mounts.
    What do I need to do? If you use Tailscale Serve with TLS enabled, upgrade to Tailscale version 1.104.4 or newer.

Check your version

Run these on each node, including servers and containers. They only print information.

These commands run on your own machine and only read what is installed there: versions, issuers, validity dates and trust-store entries. PatchBell does not scan your systems.

Any node with the Tailscale command line

Prints the Tailscale version of this node. Compare it with the fixed release named in the bulletins above; a lower version needs the update.

tailscale version

Tool documentation: Tailscale documentation

Quoted text
To determine the current version on a client, run tailscale version .
version Print the version of Tailscale.

Upgrade

These commands run on your own machine and only read what is installed there: versions, issuers, validity dates and trust-store entries. PatchBell does not scan your systems.

Any node with the Tailscale command line

Updates Tailscale to the latest version in your current track. Unlike the check above, this changes the installed client; use your usual update method if you manage versions centrally.

tailscale update

Tool documentation: Tailscale documentation · Tailscale documentation

Quoted text
Update to the latest version within your current track (stable or unstable, depending on what you're running): tailscale update
Alternatively, you can update Windows clients by running the Tailscale CLI command tailscale update .
  1. List the nodes that run Tailscale SSH, and the nodes that use Tailscale Serve.
  2. On each one, run the version check and compare it with the fixed release named above.
  3. Update every node that is below it, with your normal update method or the update command.
  4. If a node that allows SSH forwarding cannot be updated yet, apply Tailscale's mitigation from the forwarding section above and restart the service.
  5. Run the version check again and confirm that every node is at the fixed release or newer.