A researcher published 11 Tailscale findings with no CVE and no fix. The one that matters turns an approved device into root
2026-10-26Security
The report says Tailscale SSH's socket forwarding runs as root and a rename race defeats its path allowlist. It is lateral movement from a foothold, not internet-facing code execution, and nobody else has reproduced it yet.