TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#1

Post by jervant » Wed, Jul 15, 2026, 1:08 AM UTC

TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
tailscale.com

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#2

Post by tptacek » Wed, Jul 15, 2026, 1:27 AM UTC

This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to.

(If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#3

Post by e40 » Wed, Jul 15, 2026, 1:37 AM UTC

So, giving access via tailscale but using OpenSSH is safe, right?

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#4

Post by lugoues » Wed, Jul 15, 2026, 1:41 AM UTC

e40 wrote: post #3

So, giving access via tailscale but using OpenSSH is safe, right?

Yes, this only involves their wrapper that is managed by ACL rules.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#5

Post by kbumsik » Wed, Jul 15, 2026, 1:44 AM UTC

Why own numbering instead of CVE?

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#6

Post by vngzs » Wed, Jul 15, 2026, 1:50 AM UTC

kbumsik wrote: post #5

Why own numbering instead of CVE?

It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#7

Post by cyberax » Wed, Jul 15, 2026, 1:52 AM UTC

> "Tailscale SSH now rejects usernames with leading dashes."

Really? That's the fix?

A proper fix is to use "--" to separate arguments.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#8

Post by sedatk » Wed, Jul 15, 2026, 1:54 AM UTC

cyberax wrote: post #7

> "Tailscale SSH now rejects usernames with leading dashes." Really? That's the fix? A proper fix is to use "--" to separate arguments.

Their fix just future-proofs it in case the same bug gets reintroduced.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#9

Post by doublepg23 » Wed, Jul 15, 2026, 1:59 AM UTC

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#10

Post by modeless » Wed, Jul 15, 2026, 2:08 AM UTC

Tailscale SSH has caused me other problems in the past because it takes over port 22. I'm not a fan.