>>> We would like to thank Anthropic and Ada Logics for reporting this issue.
it seems anthropic also use tailscale or it's just being discovered by the mythos model?
TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
31–40 of 157 posts
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#32pure logic error, the undergoing tailscale rust rewrite can't help this too:)
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#33pure logic error, the undergoing tailscale rust rewrite can't help this too:)
that said, the limit impact perhaps is only affected multiple users in tailnet if the ACL is not configure correctly
As single tailnet+single user, perhaps it's just okay
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#34I'll stick to my 100% self-hosted Wireguard setup, thank you very much.
Why not tailscale plus head scale for self hosting?
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#35Earlier quoted context omitted.
Their fix just future-proofs it in case the same bug gets reintroduced.
This is just a dirty fix. It adds weird restrictions and masks issues. Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#36Earlier quoted context omitted.
Their fix just future-proofs it in case the same bug gets reintroduced.
A correct implementation would be to just call glibc directly, this seems like a hasty fix to get the patch out the door. The history of vulns from bad shell escaping is as old as bash, whenever possible you probably shouldn't be mixing code and data, especially in a security critical application like this.
The fact that there is no portable way to link the relevant functions that works reliably across all distributions of Linux is a failure of POSIX and GNU, and unfortunately is largely the Linux distribution story in a nutshell.
Your answer is mostly correct, except that when you tug on that thread the shelf comes off the wall, the plaster comes with it, and then it cracks the water pipes on the way to the floor.
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#37I'll stick to my 100% self-hosted Wireguard setup, thank you very much.
haha self hosted wireguard, an opportunity to find out AllowedIPs: 0.0.0.0/0 does the opposite of what you think it will do
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#38Sadly, yet another path to root via Tailscale.
If their scope grows, and they run so much as root, it won't be their last.
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#39> "Tailscale SSH now rejects usernames with leading dashes." Really? That's the fix? A proper fix is to use "--" to separate arguments.
“--“ doesn’t work on all versions of getent.
A better fix is to call “getent passwd” with no user controlled arguments and then parse the resulting list. This gets rid of the input sanitization problem entirely.
Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
#40Why own numbering instead of CVE?
Some reasons why an org might want to become their own CNA: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/