# Tailscale SSH Vulnerability Allowed Root Access

Insecure argument handling in Tailscale SSH permitted root access.

- **Source:** [Hacker News: Front Page](https://brifing.si/source/b07aa772-b1a0-4a76-aa18-719c6f9e2dde)
- **Published:** 2026-07-15
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://tailscale.com/security-bulletins>
- **On Brifing:** https://brifing.si/s/50a26ab5-eebe-49ed-a8ee-fbb9f0974422

## Introduction

A security vulnerability in Tailscale SSH allowed root user access. This flaw originated from improper argument handling on Linux platforms, violating ACL policies.

## Root Cause

Tailscale SSH accepted usernames with a leading '-' character. These usernames were passed as arguments to the getent command on Linux, leading to root access.

## Impact of the Vulnerability

When a user connected with the username '-i', the getent command printed the entire passwd file starting with the root user, opening a root session.

## Who Was Affected?

Users of Tailscale SSH on Linux servers relying on autogroup:nonroot restrictions in ACLs were affected by this vulnerability.

## Solution

Tailscale SSH now rejects usernames with leading '-' characters. This security vulnerability has been fixed in Tailscale version 1.98.9 and later.

## What You Need to Do

If you use Tailscale SSH, it is recommended to upgrade to Tailscale version 1.98.9 or newer.

## Credits

We would like to thank Anthropic and Ada Logics for reporting this issue.

## Other Vulnerabilities

Other security vulnerabilities were identified in Tailscale, including HTTP requests locking the CPU and Services allowing access to loopback listeners.

## HTTP Request Issue

Tailscale Serve and Funnel could lock the CPU when handling HTTP requests that did not reach the root path. This issue was fixed in Tailscale 1.98.9.

## Services Issue

Tailscale Services allowed access to loopback listeners on non-advertised ports. This issue was fixed in Tailscale 1.98.9.

## UID Issue

Tailscale SSH allowed users to be addressed by UID, bypassing root restrictions. This issue was fixed in Tailscale 1.98.9.

## Conclusion

These security vulnerabilities in Tailscale underscore the importance of keeping software up to date for system administrators.

## Sources covering this story

- https://tailscale.com/security-bulletins — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._