I got community noted, muted and insulted on Sunday for trying to warn people.
Yes, you need tailnet access first. But an approved user getting privileges they shouldn't have is still bad.
Hope everyone that called me a retard took a second look at their Tailscale config 👇
‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real.
Its new investigation page says most of what it found is privilege escalation and calls the issues “serious.” Fix targeted within 24 hours — no CVE or patched version out yet.
Mitigate now:
→ Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service and restart
→ Tighten SSH access rules to the users/devices that need them
Read: