Weaknesses disclosed in Tailscale SSH could let an attacker expand access after compromising an authorized device. In laboratory testing, chained issues produced root access on reachable servers and exposed keys that could add rogue devices. An automated attack moved between policy-approved servers without user interaction. At the time of reporting, fixes had reached public code repositories but not a numbered client release.
Why It Matters
This is not an unauthenticated route into arbitrary systems; the attacker first needs a foothold on an authorized device. For leaders: the damage depends heavily on how broadly SSH access and forwarding are permitted. For defenders: unnecessary forwarding and permissive network policy increase the potential blast radius. No in-the-wild exploitation was reported. Trusted device identity does not remove the need for least-privilege access rules.
What Defenders Should Do
Review Tailscale SSH policy, disable forwarding where unnecessary and deploy the fixed numbered client release as soon as it is available.