TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to.

(If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.

I don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.

> Tailscale SSH now rejects usernames with leading dashes.

Is the proper fix not restricting users not possible in these poorly designed ancient systems?

Similarly re another issue: why not just fix the permission issues instead of restricting users?

> Tailscale now disallows the use of UIDs or numeric-only usernames via SSH to avoid this ambiguity

I'll stick to my 100% self-hosted Wireguard setup, thank you very much.

tailscale ssh: replacing a 25-year-old battle-tested codebase with a startup's Go rewrite and then acting surprised when it has bugs

So, giving access via tailscale but using OpenSSH is safe, right?

Tailscale SSH has caused me other problems in the past because it takes over port 22. I'm not a fan.

>>> We would like to thank Anthropic and Ada Logics for reporting this issue.

it seems anthropic also use tailscale or it's just being discovered by the mythos model?

pure logic error, the undergoing tailscale rust rewrite can't help this too:)

Why own numbering instead of CVE?

> "Tailscale SSH now rejects usernames with leading dashes."

Really? That's the fix?

A proper fix is to use "--" to separate arguments.

Sadly, yet another path to root via Tailscale.

If their scope grows, and they run so much as root, it won't be their last.

[dead]