```
Tailscale has published version 1.104.4, a security update addressing flaws in its built-in SSH server that could allow an attacker to reach services and files on other machines that only the root user should be able to touch, according to a report from The Hacker News.
The bugs sit in the connection-forwarding path used by Tailscale SSH — the mechanism by which the Tailscale background process relays network connections on behalf of an established session, a job it performs with root privileges. Because that relay runs privileged, a session that has already cleared Tailscale SSH's access-control checks can be carried onward into resources it should not have been able to reach.
Exploitation is not a drive-by affair: an attacker needs a foothold first, on a device or session already inside the tailnet. Prerequisites, the affected version range, and any CVE assignments are detailed in Tailscale's 1.104.4 release notes.
Why this bug class matters
Tailscale SSH concentrates trust in a privileged broker. Rather than every node holding its own SSH credentials and exposure, the daemon negotiates and forwards on the operator's behalf. That design removes internet-facing surface and simplifies key management — but it also means the blast radius of a single compromised endpoint is wider than with a conventional local privilege-escalation bug.
A hardened laptop, a CI runner, or a staging box that would otherwise be stuck at its own user privileges becomes a launch point toward root-level resources on peer servers, with no new external attack surface required. For teams that adopted Tailscale SSH precisely to reduce standing exposure, that inversion is the part worth pausing on.
What operators should do
- Upgrade to Tailscale 1.104.4 now. Prioritise any node running the built-in SSH server, then roll out to the rest of the fleet on the normal maintenance cadence.
- Audit your exposure. Inventory which devices have Tailscale SSH enabled — including ephemeral nodes, CI runners, and developer laptops that may be offline during the rollout — and review whether any ACL grants broader reach than current role definitions require, trimming rules that were widened for convenience during migrations or incidents.
- Track the release notes. Confirm the affected version range, any CVE assignments, and guidance on interim mitigations for systems that cannot be patched immediately — Tailscale's own notes are the authoritative source for those details.
Because Tailscale SSH places its identity-based perimeter inside a privileged daemon by design, flaws in that daemon's forwarding logic warrant the same urgency as flaws in an internet-facing service. Teams running the built-in SSH server should treat 1.104.4 as an immediate action item rather than a routine maintenance roll.
The full report is available at The Hacker News, with patch details in Tailscale's 1.104.4 release notes.
```
據 The Hacker News 報道，Tailscale 已發布 1.104.4 版本，屬一項保安更新，用於修補其內建 SSH 伺服器的漏洞。該等漏洞可令攻擊者接觸其他機器上的服務及檔案，而有關資源理應只有 root 用戶才能存取。
漏洞位於 Tailscale SSH 所使用的連線轉發路徑上——即 Tailscale 背景程式代已建立的 session 轉送網絡連線的機制，而該工作是以 root 權限執行。由於該轉發程序以高權限運行，任何已通過 Tailscale SSH 存取控制檢查的 session，均可被進一步轉送至其本不應接觸的資源。
漏洞並非可被隨意利用：攻擊者須先取得立足點，即已在 tailnet 內的裝置或 session 中安插據點。先決條件、受影響版本範圍及相關 CVE 編號，詳情載於 Tailscale 的 1.104.4 發布說明。
為何這類漏洞值得重視
Tailscale SSH 將信任集中於一個高權限的中介代理（broker）之中。系統管理 daemon 會代操作者協商並轉發連線，而非讓每個節點各自持有 SSH 憑證並暴露於風險之中。此設計移除了面向互聯網的攻擊面，並簡化金鑰管理（key management）——但同時亦意味著單一終端一旦被入侵，其爆炸半徑（blast radius）較傳統的本地權限提升（local privilege escalation）漏洞更為廣泛。
一部原本受用戶權限限制的強化筆電、CI runner 或 staging 機器，可一舉成為通往對等伺服器 root 級資源的跳板，而且毋須新增任何對外攻擊面。對於特意採用 Tailscale SSH 以降低長期暴露風險的團隊而言，這種形勢逆轉正是值得停下來審視之處。
營運及維護人員應採取的行動
- 立即升級至 Tailscale 1.104.4。 優先處理任何運行內建 SSH 伺服器的節點，其餘節點則按正常維護周期逐步推出。
- 審視自身暴露面。 盤點哪些裝置已啟用 Tailscale SSH——包括 ephemeral 節點、CI runner，以及可能在推出更新期間離線的開發者筆電——並檢視是否有任何 ACL 的授權範圍超出目前角色定義所需，同時收緊在遷移或事故期間因方便而放寬的規則。
- 追蹤發布說明。 確認受影響版本範圍、任何 CVE 編號，以及無法即時修補系統的臨時緩解措施指引——Tailscale 自身的發布說明是該等詳情的權威來源。
由於 Tailscale SSH 按設計將其基於身份的邊界置於一個高權限 daemon 之內，該 daemon 轉發邏輯中的缺陷，與面向互聯網服務的缺陷同樣需要緊急處理。運行內建 SSH 伺服器的團隊應將 1.104.4 視為即時行動項目，而非例行維護更新。
完整報告可參閱 The Hacker News，修補詳情則載於 Tailscale 的 1.104.4 發布說明。