Tailscale SSH: Investigation and remediation update

Tailscale reports an active investigation into security vulnerabilities in Tailscale SSH, conducted by its engineering and security teams with outside specialists. Most identified issues involve privilege escalation: in certain circumstances, a user already permitted to connect through Tailscale SSH could do more than their assigned local account allows, potentially including gaining elevated privileges. Exploitation depends on the user’s or device’s permissions, system configuration, and other conditions; the full range of affected setups is still being verified. The company characterizes the findings as serious but says its current assessment does not justify recommending that all customers disable Tailscale SSH.

Most fixes have been implemented, and testing is underway before a patched client release targeted for the end of October 27, 2026. In the meantime, customers are advised to restrict SSH access policies to necessary users and devices, consider tightening access to sensitive systems, and prepare to install the update. Those who do not need SSH forwarding can disable it by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service; this preserves Tailscale SSH while mitigating several serious findings. After the fixes are released, Tailscale plans to publish a security advisory with confirmed vulnerabilities, affected versions and configurations, and remediation details, followed by a technical explanation of the causes and engineering changes.