Tailscale SSH: Investigation and remediation update
- ID
- 40391
- Status
- summarized
- Published
- 28 Oct 2026, 3:55 AM
- Fetched
- 28 Oct 2026, 10:54 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://tailscale.com/ssh-investigation-update
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.8
- Created
- 28 Oct 2026, 10:55 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Tailscale published four security bulletins (TS-2026-014 through TS-2026-017) for Tailscale SSH vulnerabilities, most involving privilege escalation where an already-authorized connector may act beyond its configured local user permissions. Tailscale says fixes for most issues are implemented and a patched client is targeted for release by end of Tuesday 27 October, and it is not recommending everyone disable Tailscale SSH. Interim guidance includes setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service, plus tightening SSH access policies.
Why it matters
If your team uses Tailscale SSH, decide now whether to set TS_SSH_DISABLE_FORWARDING=1 and restart tailscaled, and review which users and devices can connect; that mitigation is available before the patched client lands. Plan the client update once released rather than assuming current access policies fully contain the privilege-escalation findings.
Discussion angle
How would you audit whether your Tailscale SSH users actually need forwarding, and what access-policy change would you make before the patched client lands?