9 ms·
TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
- mintflow 2mo ago>>> We would like to thank Anthropic and Ada Logics for reporting this issue. it seems anthropic also use tailscale or it's just being discovered by the mythos model?
- tristanj 2mo agoI presume Ada Logics has access to Anthropic's Mythos model via Project Glasswing, and Ada Logics discovered this exploit during their vulnerability research.
- farfatched 2mo agoSadly, yet another path to root via Tailscale. If their scope grows, and they run so much as root, it won't be their last.
- e40 2mo agoSo, giving access via tailscale but using OpenSSH is safe, right?
- iririririr 2mo agoas much as handing control to a remote third part is, yes.
- cevn 2mo agoGood point. I self host headscale but it also has the ssh feature, probably also insecure.
- OJFord 2mo agoNot necessarily, it's a clean room implementation. Even if leading dashes was known/documented/tested to implement they might have done it differently. And maybe it was an implementation detail that it was ever allowed, but that's a weird username, headscale implementation happened not to allow it, and nobody ever noticed the discrepancy.
- cevn 2mo agoNice, this makes me feel a little better.
- saintfire 2mo agoHow is that true if: This project is not associated with Tailscale Inc. However, one of the active maintainers for Headscale is employed by Tailscale and he is allowed to spend work hours contributing to the project. Contributions from this maintainer are reviewed by other maintainers.
- lugoues 2mo agoYes, this only involves their wrapper that is managed by ACL rules.
- tptacek 2mo agoThis is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to. (If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)
- iririririr 2mo agoyou can also add parameters to env vars in some popular cloud providers for the same effect.
- RossBencina 2mo agoI'm somewhat alarmed that the context that this bug was running in was capable of root login. Is there a reason that an SSH login process would, by default, have enough capabilities to facilitate direct root login?
- yjftsjthsd-h 2mo agoIf it runs as your user and can only log in as you, then I wouldn't expect it to be able to become root. But if it can log you in as different users, I would expect that 1. it needs to run from root, and 2. it can log in as root.
- anilakar 2mo agoWe did Tailscale-like SSH reverse tunnels at scale first in 2013 and the main issue has always been that there are no good libraries. Bash scripting around the OpenSSH binaries is pretty much the only way to go. There's Paramiko, but Python is still a huge liability in memory-constrained systems.
- formerly_proven 2mo agolibssh, libssh2. These are totally independent and unrelated code bases, libssh is maintained by Red Hat mainly for ansible and some other tools, libssh2 was created for curl. libssh2 is client-only, libssh can also be used to implement servers.
- kbumsik 2mo agoWhy own numbering instead of CVE?
- vngzs 2mo agoIt lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling
- bigfatkitten 2mo agoAnd sometimes it’s just impossible to get a CVE number in a reasonable amount of time, or indeed at all.
- cyphar 2mo agoIn my experience it is really very quick and easy to get a CVE if you contact MITRE directly, and on paper you do not need to disclose too much. The GitHub CNA is (ironically) very slow by comparison but that is a GitHub issue. Tailscale can also just apply to be their own CNA and issue CVEs for their products themselves, eliminating any such issues entirely.
- wereHamster 2mo agoSome reasons why an org might want to become their own CNA: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/ https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/
- Retr0id 2mo agoTo be clear creating your own custom IDs isn't the same thing as being a CNA, but some of the motivations are the same.
- cyberax 2mo ago> "Tailscale SSH now rejects usernames with leading dashes." Really? That's the fix? A proper fix is to use "--" to separate arguments.
- sedatk 2mo agoTheir fix just future-proofs it in case the same bug gets reintroduced.
- cyberax 2mo agoThis is just a dirty fix. It adds weird restrictions and masks issues. Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
- sedatk 2mo agoI argue the opposite: there’s no better fix for this. You can write the most elegant fix, whatever it is, and prevent that from happening only on the codebase that’s fixed. That doesn’t mean that the codebase will always be the only authority on authentication. The username policy fixes this issue for good, regardless of whatever you write in the future, or whatever new mechanism is introduced. It’s a restriction for sure, but it’s not a nonsense restriction? Who would have a username starting with a hyphen? I didn’t even know it was possible until today.
- doublepg23 2mo agoI’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.
- theshrike79 2mo agoThe advantage of tailscale ssh is that the machine doesn't need to have the ssh port open publicly.
- jdiff 2mo agoI've used it before to access my tailnet machines through a browser on a machine I can't download software on.
- Shorel 2mo agoI just don't use stranger's machines to access my personal stuff. Possibly compromised stranger's machines. I don't see the benefit about that, as I have more laptops than I need.
- jdiff 2mo agoThat's cool. Others are not like you and may have use/need of things that you have no use/need for is what I'm trying to communicate here.
- isatty 2mo agoConvenience for the most part but in general, I agree. I like having it as an option.
- bakies 2mo agoYeah pretty much just use tailscale as a vpn.. do one thing as they say.
- dgacmu 2mo agoI used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.
- modeless 2mo agoTailscale SSH has caused me other problems in the past because it takes over port 22. I'm not a fan.
- newdee 2mo agoIt takes over port 22 on the Tailscale interface only. Only had problems with this when I’ve wanted to hit a host’s non-Tailscale ssh service via Tailscale. Otherwise it’s been great for me
- huflungdung 2mo ago[dead]
- LeoPanthera 2mo agoThat is what it's supposed to do, though. It's not a secret.
- deleted 2mo ago[deleted]
- drnick1 2mo agoI'll stick to my 100% self-hosted Wireguard setup, thank you very much.
- m_mueller 2mo agoWhy not tailscale plus head scale for self hosting?
- diarrhea 2mo agoI do not understand this rebuttal. I also run self-hosted Wireguard. Initially on a Debian box, nowadays it is integrated into my router (admittedly, this is closed source). For around 6 years at this point. The whole thing could not be easier and simpler. It has never randomly broken on me. It is fast. It is free. There is no middle man, no vendor. I never understood the popularity of Tailscale, though that is on me. I'm sure it is a great product, I just never tried it, do not seem the target audience. What confuses me is the often accompanying, sometimes aggressive anti-selfhosting stance in these sorts of threads. I do not see this in other topics, e.g. someone mentioning they run Jellyfin isn't met with "why not Plex?". Where does that come from? We are on HackerNews, not ProductShillNews, aren't we? I guess self hosting Wireguard is too boring to warrant any further discussion? The VPN equivalent of a Toyota Corolla.
- theshrike79 2mo ago> I never understood the popularity of Tailscale, though that is on me. I'm sure it is a great product, I just never tried it, do not seem the target audience. Can you talk an $elderly_relative through a wireguard installation on the phone so they can join your VPN? I've done it with Tailscale and it's a breeze.
- MobiusHorizons 2mo agoI think Tailscale is popular because of how plug and play it is for most people. Although the main reason I use it over self hosting wireguard is the NAT busting it does, which has so far worked flawlessly for me with no setup aside from installing on both devices. There is nothing wrong with self hosting wireguard, but it doesn't actually do the same job as tailscale.
- luciana1u 2mo ago[flagged]
- deleted 2mo ago[deleted]
- mintflow 2mo agopure logic error, the undergoing tailscale rust rewrite can't help this too:)
- mintflow 2mo agothat said, the limit impact perhaps is only affected multiple users in tailnet if the ACL is not configure correctly As single tailnet+single user, perhaps it's just okay
- bestouff 2mo agoIf it used one of the standard arguments-handling crates (e.g. "clap") there's no way it can happen.
- pferde 2mo agoIf it used one of the standard system APIs for looking up user accounts (e.g. getpwnam(3)), there's no way it can happen. This is incredibly bad engineering, on level of a SQL injection, in 21st century. Something a highschool student experimenting with scripting could come up with, but not a supposedly professional software company.
- bestouff 2mo agoAgreed.
- ishweta 2mo ago[dead]
- eviks 2mo ago> Tailscale SSH now rejects usernames with leading dashes. Is the proper fix not restricting users not possible in these poorly designed ancient systems? Similarly re another issue: why not just fix the permission issues instead of restricting users? > Tailscale now disallows the use of UIDs or numeric-only usernames via SSH to avoid this ambiguity
- pferde 2mo agoThe proper fix would be to not use getent CLI tool in their logic, but instead use proper system APIs for looking up user account entries, like one of earlier comments here already mentions. This is shocking amateur hour! My guess is they hastily threw together something hacky in early development, and forgot to replace it with a real, safe solution later.
- rfoo 2mo agoThe issue here is there is NO single system API for looking up user account entries on Linux. It's implemented in libc. So you need to link to libc. Tailscale is a Go binary, and they probably prefer it to be statically-linked. glibc NSS implementation also REQUIRES you to load `.so` so you just can't emulate it in Go. Then, "link to libc". Which libc? glibc? musl?
- Chu4eeno 2mo ago> The issue here is there is NO single system API for looking up user account entries on Linux. Yes there is, and you answered in the next line, it is implemented in libc. If you want to check authentication use libc don't try to implement crypto and authentication yourself.
- pferde 2mo agoBut of course there is, it's part of POSIX, implemented in libc. And if you're using a higher level language, they all have their own wrappers around libc/POSIX APIs. Here is golang's: https://pkg.go.dev/os/user https://pkg.go.dev/os/user
- s_ting765 2mo agoI don't see the point of publishing a security bulletin if you are not going to timely push the fix to artifacts on all affected platforms. Tailscale needs to do better on their release process, docker hub shows last update was 8 days ago.
- dijit 2mo agoso you can disable or mitigate it…
- dust-jacket 2mo agoI don't mind having a bulletin so much as the claim that it's fixed in 1.98.9 or newer, when that release doesn't appear to exist yet. Feels pretty weird practice to advise upgrading to a non-existent version.
- s_ting765 2mo ago1.98.9 has already been tagged since bulletin was published (don't know why they chose on github to tag but not release). 1.98.9 version exists! That's not the question. It should already have been made available for Linux distros assuming this resource from Tailscale is accurate https://pkgs.tailscale.com/stable/?v=1.98.9 https://pkgs.tailscale.com/stable/?v=1.98.9 Edit: Their changelog also mentions the version: https://tailscale.com/changelog#all https://tailscale.com/changelog#all
- dust-jacket 2mo agoAh, OK, its the weird GitHub non-release that threw me. Thank you!
- jcarrano 2mo ago> usernames were passed as arguments to getent(1) to retrieve the corresponding passwd entry Always try to use actual API/system calls (in this case getpwnam) instead of calling sub-processes.
- traceroute66 2mo agoAt $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much fear at $work that there are vulnerabilities in the Tailscale product awaiting discovery. Especially as, AFAIK, Tailscale have never had a formal security audit on their software. So we install it on hardened bastion hosts in an old-school "jump host" model. So people can still get access to where they need to be, but we don't need to install Tailscale's unaudited shit on every single server / vm / etc. And we only use Tailscale as a glorified VPN, we don't use their hundreds of extra random features like this SSH one. In terms of SSH, we use old-school OpenSSH and SSH certificates. Its really not that difficult and its really not expensive, you can do offline signing with Yubikeys, no need for expensive HSMs.
- fragmede 2mo agoTailscale contracts with cybersecurity firm Latacora to conduct traditional assessments, advisory services, design reviews, auditing and testing. https://tailscale.com/security https://tailscale.com/security
- traceroute66 2mo ago> Tailscale contracts with cybersecurity firm Latacora to conduct And these published audits of the `tailscale` software are where ? Even half-serious VPN providers like Mullvad publish in public their regular security audits of their app and infrastructure. There is zero reason Tailscale cannot do the same. And frankly, given the nature of this vulnerability, "insecure argument handling" I'm not entirely sure it has been audited ? Or if it has, they should be looking for a new auditor ASAP !
- _joel 2mo agoAgree, but I'd class Mullvad as the most serious VPN provider, personally.
- TacticalCoder 2mo agoI'll fix this entire HN thread for you all and you'll thank me later: s/bug/backdoor/g
- aftbit 2mo agoIt appears that tailscale ssh is off by default? How can I validate that? When I try to log in, I just get: No ED25519 host key is known for $host and you have requested strict checking.
- dcow 2mo agoWhy does the page only show up to 008? Did TS remove the notice? Edit: my bad, it's between 008 and 007 ?=