alt Hacker NewsDo you use tailscale ssh but either dont have sudo, or don't permit login as root?
If all your tailscale-ssh ACLs allow you into an account with sudo, or allow you into root, theres no impact (you cant do anything with these vulns you couldnt do a month ago). Thats the nuance I'm trying to get across (admittedly my english is bad).
On the majority of nodes I provide Tailscale SSH access to, it's as root or a user with passwordless sudo. It's being used for admin access. So yeah, on those it doesn't matter as much.
There are a handful which restrict users to their own user accounts. But it's on dev server with friendly devs, so even for that use case it's not really the end of the world.
I'm sure our infosec folks are going to demand that we upgrade everywhere, however.