Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

tailscale.com

Post reply on HN
Print view View original

81–90 of 157 posts

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#81

Post by Chu4eeno »

rfoo wrote: post #79
pferde wrote: post #71

Earlier quoted context omitted.

The proper fix would be to not use getent CLI tool in their logic, but instead use proper system APIs for looking up user account entries, like one of earlier comments here already mentions. This is shocking amateur hour! My guess is they hastily threw together something hacky in early development, and forgot to replace it with a real, safe solution later.

The issue here is there is NO single system API for looking up user account entries on Linux. It's implemented in libc. So you need to link to libc. Tailscale is a Go binary, and they probably prefer it to be statically-linked. glibc NSS implementation also REQUIRES you to load `.so` so you just can't emulate it in Go. Then, "link to libc". Which libc? glibc? musl?

> The issue here is there is NO single system API for looking up user account entries on Linux.

Yes there is, and you answered in the next line, it is implemented in libc.

If you want to check authentication use libc don't try to implement crypto and authentication yourself.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#82

Post by unprovable »

tptacek wrote: post #2

This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to. (If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)

It's so old skool, it's almost new again... almost... Still waiting for that third (or fourth?!) wave of XXE (or similar) bugs.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#83

Post by pferde »

rfoo wrote: post #79
pferde wrote: post #71

Earlier quoted context omitted.

The proper fix would be to not use getent CLI tool in their logic, but instead use proper system APIs for looking up user account entries, like one of earlier comments here already mentions. This is shocking amateur hour! My guess is they hastily threw together something hacky in early development, and forgot to replace it with a real, safe solution later.

The issue here is there is NO single system API for looking up user account entries on Linux. It's implemented in libc. So you need to link to libc. Tailscale is a Go binary, and they probably prefer it to be statically-linked. glibc NSS implementation also REQUIRES you to load `.so` so you just can't emulate it in Go. Then, "link to libc". Which libc? glibc? musl?

But of course there is, it's part of POSIX, implemented in libc. And if you're using a higher level language, they all have their own wrappers around libc/POSIX APIs. Here is golang's: https://pkg.go.dev/os/user

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#84

Post by dust-jacket »

gear54rus wrote: post #75
nicman23 wrote: post #44

Earlier quoted context omitted.

i really dislike that there is no way to do dhcp for new clients and that i have to manually define peers in each "exit node"

Because wireguard to tailscale is like git to git GUIs. It's solid base but never should be used separately without a proper wrapper if one wants to keep one's sanity.

But are there any good self-hosted wrappers?

I ditched wireguard for tailscale for the ease of managing it. I'd much rather run my own independently but CBA with the config editing hassle.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#85

Post by dust-jacket »

s_ting765 wrote: post #62

I don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.

I don't mind having a bulletin so much as the claim that it's fixed in 1.98.9 or newer, when that release doesn't appear to exist yet. Feels pretty weird practice to advise upgrading to a non-existent version.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#86

Post by maxgashkov »

diarrhea wrote: post #43
m_mueller wrote: post #34

Earlier quoted context omitted.

Why not tailscale plus head scale for self hosting?

I do not understand this rebuttal. I also run self-hosted Wireguard. Initially on a Debian box, nowadays it is integrated into my router (admittedly, this is closed source). For around 6 years at this point. The whole thing could not be easier and simpler. It has never randomly broken on me. It is fast. It is free. There is no middle man, no vendor. I never understood the popularity of Tailscale, though that is on me…

> I never understood the popularity of Tailscale, though that is on me.

> I guess self hosting Wireguard is too boring to warrant any further discussion?

It's popular because you don't have to deal with NAT punching. It "just works", all the time. And Wireguard is not too boring, it's just not enough on its own.

I'm all for self-hosting and this is exactly why I prefer to use Tailscale and not have to manage jump-hosts and STUN points on some cloud, given that I won't be able to make it as reliable as Tailscale and as cheap as Tailscale (effectively $0). So this is literally the only tradeoff I made while self-hosting everything else.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#87

Post by traceroute66 »

At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups.

But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years.

We very much fear at $work that there are vulnerabilities in the Tailscale product awaiting discovery. Especially as, AFAIK, Tailscale have never had a formal security audit on their software.

So we install it on hardened bastion hosts in an old-school "jump host" model. So people can still get access to where they need to be, but we don't need to install Tailscale's unaudited shit on every single server / vm / etc.

And we only use Tailscale as a glorified VPN, we don't use their hundreds of extra random features like this SSH one.

In terms of SSH, we use old-school OpenSSH and SSH certificates. Its really not that difficult and its really not expensive, you can do offline signing with Yubikeys, no need for expensive HSMs.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#88

Post by jdiff »

Shorel wrote: post #45
jdiff wrote: post #11

Earlier quoted context omitted.

I've used it before to access my tailnet machines through a browser on a machine I can't download software on.

I just don't use stranger's machines to access my personal stuff. Possibly compromised stranger's machines. I don't see the benefit about that, as I have more laptops than I need.

That's cool. Others are not like you and may have use/need of things that you have no use/need for is what I'm trying to communicate here.

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#89

Post by s_ting765 »

dust-jacket wrote: post #85
s_ting765 wrote: post #62

I don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.

I don't mind having a bulletin so much as the claim that it's fixed in 1.98.9 or newer, when that release doesn't appear to exist yet. Feels pretty weird practice to advise upgrading to a non-existent version.

1.98.9 has already been tagged since bulletin was published (don't know why they chose on github to tag but not release).

1.98.9 version exists! That's not the question. It should already have been made available for Linux distros assuming this resource from Tailscale is accurate https://pkgs.tailscale.com/stable/?v=1.98.9

Edit: Their changelog also mentions the version: https://tailscale.com/changelog#all

Re: TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

#90

Post by fragmede »

traceroute66 wrote: post #87

At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much…

Tailscale contracts with cybersecurity firm Latacora to conduct traditional assessments, advisory services, design reviews, auditing and testing.

https://tailscale.com/security

Post reply on HN