{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2026-014",
  "link": "https://tailscale.com/security-bulletins/#ts-2026-014",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2026-014",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Mon, 26 Oct 2026 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale SSH Unix socket forwarding could grant peers access to root-only sockets.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e allows the forwarding of TCP and Unix sockets between a client and a host. The SSH server in the root-privileged \u003ccode\u003etailscaled\u003c/code\u003e process validated Unix socket paths lexically but would perform the operations as root. This created three vulnerabilities. First, it allowed privileged dials via local forwarding (\u003ccode\u003essh -L\u003c/code\u003e). Second, it allowed socket replacement via remote forwarding (\u003ccode\u003essh -R\u003c/code\u003e) by unlinking root-owned sockets. Third, a race condition defeated the path allowlist because the kernel re-resolves paths after the initial check.\u003c/p\u003e\n\u003cp\u003eThese issues combined to remove the path allowlist as a security boundary. This gave authenticated peers with authorized forwarding access a route to root-only Unix sockets on the node.\u003c/p\u003e\n\u003cp\u003eTailscale now performs Unix socket forwarding on behalf of the authenticated user rather than as root.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker could reach root-only sockets such as the Docker socket or the \u003ccode\u003etailscaled\u003c/code\u003e local API.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eThis issue affects users with Tailscale SSH enabled who also allow local or remote forwarding in their access policies.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale SSH with local or remote forwarding, upgrade to Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003cp\u003eAs a mitigation, you can disable SSH forwarding by setting \u003ccode\u003eTS_SSH_DISABLE_FORWARDING=1\u003c/code\u003e in the \u003ccode\u003etailscaled\u003c/code\u003e service environment and restarting the service. This disables forwarding without disabling all of Tailscale SSH.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale SSH Unix socket forwarding could grant peers access to root-only sockets.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e allows the forwarding of TCP and Unix sockets between a client and a host. The SSH server in the root-privileged \u003ccode\u003etailscaled\u003c/code\u003e process validated Unix socket paths lexically but would perform the operations as root. This created three vulnerabilities. First, it allowed privileged dials via local forwarding (\u003ccode\u003essh -L\u003c/code\u003e). Second, it allowed socket replacement via remote forwarding (\u003ccode\u003essh -R\u003c/code\u003e) by unlinking root-owned sockets. Third, a race condition defeated the path allowlist because the kernel re-resolves paths after the initial check.\u003c/p\u003e\n\u003cp\u003eThese issues combined to remove the path allowlist as a security boundary. This gave authenticated peers with authorized forwarding access a route to root-only Unix sockets on the node.\u003c/p\u003e\n\u003cp\u003eTailscale now performs Unix socket forwarding on behalf of the authenticated user rather than as root.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker could reach root-only sockets such as the Docker socket or the \u003ccode\u003etailscaled\u003c/code\u003e local API.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eThis issue affects users with Tailscale SSH enabled who also allow local or remote forwarding in their access policies.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale SSH with local or remote forwarding, upgrade to Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003cp\u003eAs a mitigation, you can disable SSH forwarding by setting \u003ccode\u003eTS_SSH_DISABLE_FORWARDING=1\u003c/code\u003e in the \u003ccode\u003etailscaled\u003c/code\u003e service environment and restarting the service. This disables forwarding without disabling all of Tailscale SSH.\u003c/p\u003e"
  },
  "title": "TS-2026-014",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2026-014"
  }
}