Threat intel
Unpatched Tailscale SSH Flaws Could Let a Compromised Device Gain Root on Other Servers
A security researcher has disclosed unpatched flaws in Tailscale SSH that could let a single compromised device on a Tailscale network be used to gain root access on other reachable servers, The Hacker News reported. The attack requires Tailscale SSH port forwarding to be enabled and the network's access rules to allow the compromised device to connect to the target.
A security researcher has disclosed vulnerabilities in Tailscale SSH that could allow an attacker to turn a single compromised device on a Tailscale network into a springboard for gaining root access on other servers, The Hacker News reported. The findings were published this week, and the flaws are described as unpatched.
According to the report, the attack works only when two conditions are met at the same time. First, Tailscale SSH must be configured to allow port forwarding. Second, the attacker must already control at least one device on the network — and that device must be permitted, under the network's access rules, to connect to the intended target server.
When both prerequisites hold, the legitimate connectivity that Tailscale provides between devices can reportedly be abused to escalate from control of the initial device to root-level access on the remote server. The practical consequence is that a foothold on one machine inside a Tailscale network could potentially be converted into full administrative control of additional systems that the device is allowed to reach.
Because the attack path relies on configuration choices rather than on tricking users, the findings draw attention to how Tailscale SSH deployments handle port forwarding and how access policies between devices are scoped. The details above come from The Hacker News' report on the researcher's disclosure.
Source: The Hacker News
