Unpatched Tailscale SSH flaws could let a hacked device gain root access to other servers

According to a report by a Cyberdione Labs researcher, a device compromised on a Tailscale network could be used to gain root access to other reachable servers. The findings are based on laboratory testing with Tailscale version 1.104.2 and headscale version 0.29.5; attacks against real networks were not observed. At the time of publication, Tailscale had issued no security bulletin, CVE, or fixed version, and had not confirmed the specific technical claims.