Security update for tailscale
Published Sources: OSV
What is affected, what to do
This update for tailscale fixes the following issues: Changes in tailscale: Update to version 1.104.1: + Go is updated to version 1.27 + WireGuard packet buffering uses less memory while waiting for peer handshakes + WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic + Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable + WireGuard allocates a single packet buffer for batched I/O, improving throughput and reducing memory usage + An issue that could prevent traffic over IPv6 link-local addresses from flowing through direct and Tailscale Peer Relay connections is resolved + An issue preventing Linux desktop detection from working on Wayland environments is resolved Update 1.102.5: - The container no longer stops tailscaled when it falls behind on status updates and the connection is closed, which was common on large tailnets. It reconnects instead, and exits only if it cannot reconnect within one minute.
The available sources name no fixed version. Check the vendor guidance in the references below.
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
—
Priority
No value is available for this vulnerability.
—
CVSS v3
No value is available for this vulnerability.
—
EPSS score
No value is available for this vulnerability.
Show all metrics
- Severity
- Not rated
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 30.00 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- no public PoC known
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- —
- Published
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
This update for tailscale fixes the following issues: Changes in tailscale: Update to version 1.104.1: + Go is updated to version 1.27 + WireGuard packet buffering uses less memory while waiting for peer handshakes + WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic + Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable + WireGuard allocates a single packet buffer for batched I/O, improving throughput and reducing memory usage + An issue that could prevent traffic over IPv6 link-local addresses from flowing through direct and Tailscale Peer Relay connections is resolved + An issue preventing Linux desktop detection from working on Wayland environments is resolved Update 1.102.5: - The container no longer stops tailscaled when it falls behind on status updates and the connection is closed, which was common on large tailnets. It reconnects instead, and exits only if it cannot reconnect within one minute. Update 1.102.4: - All Platforms - Resolved an issue that could cause a loss in connectivity when a netmap update occurs near the time of reauthentication. Update 1.102.3: - All Platforms - Changed: Go is updated to version 1.26.6. - Fixed: Tailscale refuses host-scoped IPv4 destinations at every point that acts on an unmapped 4via6 address. This fix addresses a security vulnerability described in TS-2026-011. - Fixed: When MagicDNS is disabled, unqualified hostnames are correctly forwarded to the configured nameservers. - Fixed: Resolved an issue where nodes with Tailnet Lock enabled on large tailnets would experience startup failures. Update 1.102.2: - Fixed: A regression causing incoming Tailscale Funnel connections to fail is resolved. Update 1.102.1: - All Platforms - tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services. - The tailscale get CLI command returns the current node's preferences. - The tailscale whoami CLI command displays information about the current user and device. - The tailscale service list CLI command displays Tailscale Services visible to the current node. - Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets. - Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals. - Deprecated formats for 4via6 MagicDNS names are no longer available to use. - TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate. - Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode. - Certificate issuance for multiple domains runs in parallel. Provisioning multiple domains does not stall each certificate behind the previous one. - Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go. - A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node. - A memory leak that occurred after a failed WireGuard handshake has been resolved. - tailscale status --peers=false command shows the current device name in the output. - Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart. - Linux - Assembly crypto routines for 32-bit ARM are available, improving performance on these platforms. - Userspace TUN optimizations improve throughput and performance. - Resolved an issue impacting performance of UDP GSO on Linux v7.0.x through v7.1.4. Update to version 1.98.10: (boo#1272825) - Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004. - Tailscale SSH preforms additional checks to disallow UIDs and numeric-only usernames. This fix covers additional scenarios described in TS-2026-006. Update to version 1.98.9: (boo#1272825) - Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004. - Tailscale Serve Unix socket proxy targets are restricted to the root user. This fix addresses a security vulnerability described in TS-2026-005. - Tailscale SSH does not allow the use of UIDs or numeric-only usernames. This fix addresses a security vulnerability described in TS-2026-006. - Nodes advertising Tailscale Services filter and reject packets from service IPs on ports they do not advertise. This fix addresses a security vulnerability described in TS-2026-007. - Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. This fix addresses a security vulnerability described in TS-2026-008. - Tailscale SSH does not allow the use of usernames with leading dashes. This fix addresses a security vulnerability described in TS-2026-009. - An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved. - An issue that could cause a crash on 32-bit ARM platforms is resolved. Update to version 1.98.8: - An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved. - An issue causing excessive handshake initiation retries in wireguard-go is resolved. - An issue causing connection leaks in Tailscale SSH Session Recording is resolved. Update to version 1.98.6: + ssh/tailssh: reject dangerous LD_/DYLD_ env vars in acceptEnv filtering + go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints + wgengine/magicsock: suppress TSMP disco advert when bestAddr is peer + control/controlknobs,wgengine/magicsock: disable TSMP disco advert if netmap caching is disabled Update to version 1.98.4: + An issue causing a deadlock when processing peer changes and disconnecting from the Tailscale control server is resolved Update to version 1.98.3: + An issue where netfilter rules could be applied inconsistently after a netfilter mode change failed has been resolved Update to version 1.98.2: + Ensure MagicDNS resolves tailnet hostnames after a network change Update to version 1.98.1: + Expired preferred peer addresses are cleared, reducing the time to elect an alternative + IP forwarding for subnet routers and exit nodes is reported as a health check + src_valid_mark sysctl is set in addition to connmark firewall rules to improve reverse path filtering and prevent dropped packets Update to verison 1.96.4: * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved * An issue that could cause a segmentation violation during startup on MIPS devices is resolved Update to version 1.96.3: * DNS resolution issue caused by NRPT rule formatting is resolved Update to version 1.96.2: * tailscale dns query|status command supports --json flag to return JSON output * tailscale wait [flags] command waits for Tailscale resources to become available for binding * tailscale ip command supports --assert=<specific-ip-address> flag to assert that one or more of the node's IP addresses matches the specified IP address * Tailscale Peer Relays advertise addresses discovered via Amazon EC2 Instance Metadata Service * tailscaled_peer_relay_endpoints gauge user metrics are available for Tailscale Peer Relays * The AuthKey system policy applies only when a user is not in a logged in state * UPnP routes as expected during long lived port mapping sessions scenarios, including hard NAT * Launch the systray application on startup using autostart file with the tailscale configure systray --enable-startup=freedesktop command * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware GOMAXPROCS defaults * Firewall rules created on Linux platforms correctly mark their traffic, avoiding reverse path filtering dropping connections and producing health warnings and risk prompts Update to version 1.94.2: * Memory leak caused by high network map response rates is resolved Update to version 1.94.1.