# Tailscale SSH Vulnerability Allowed Root Access

Critical security flaw in Linux systems permitted unauthorized root access via SSH.

- **Source:** [Hacker News](https://news.ycombinator.com)
- **Published:** 2026-07-15
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://tailscale.com/security-bulletins>
- **On Brifing:** https://brifing.si/s/b31873af-1a2f-4765-adea-6f1ae457d115

## Critical SSH Vulnerability

A security flaw in Tailscale SSH allowed unauthorized root access on Linux systems. Malicious users could gain admin privileges using specially formatted usernames. This vulnerability specifically bypassed ACL policies, posing serious security risks.

## Technical Details of the Flaw

The issue stemmed from misuse of leading '-' characters in usernames. Arguments like '-i' were passed to getent command, enabling reading of the entire passwd file and root session access. This exploited a vulnerability in Linux command argument processing logic.

## Affected Systems

All Tailscale SSH users on Linux servers relying on autogroup:nonroot restrictions were affected. This critical vulnerability existed in all Tailscale versions prior to 1.98.9, especially dangerous in multi-user environments.

## Attack Scenarios

An attacker could connect with '-i' username to obtain root privileges. This worked even when explicitly denied in ACLs, potentially leading to data breaches and system compromises, particularly on shared servers.

## Solution and Patch

Tailscale fixed the issue in version 1.98.9. The new version rejects usernames with leading dashes. Immediate upgrade is critical. System administrators should also review their ACL policies for additional protection.

## Alternative Access Methods

The vulnerability wasn't limited to SSH. Tailscale Services also allowed unauthorized access to loopback services. Version 1.98.9 fixes this by implementing proper port filtering, only allowing access to defined ports.

## UID Privilege Escalation

Another flaw allowed access via UID values. Users connecting as '0@host' could gain root access. The new version completely blocks numeric UIDs, accepting only usernames for authentication.

## Unix Socket Vulnerability

Tailscale Serve had another issue permitting unauthorized access to Unix sockets. Non-root users could access root-only sockets (like Docker socket), potentially leading to container escape scenarios.

## Denial of Service Risk

Another HTTP request vulnerability could completely consume CPU with a single malicious request, causing service outages. The new version fixes this by rejecting non-absolute paths.

## Security Audit Process

Tailscale discovered these vulnerabilities thanks to security researchers like Anthropic and Ada Logics. The company's quick resolution and transparent disclosure demonstrate its security-focused approach. Users should monitor security bulletins.

## Upgrade Instructions

Users must upgrade Tailscale clients and servers to version 1.98.9 or higher. Linux servers with SSH access should be prioritized. Post-upgrade, verify ACL policies and user permissions for complete security.

## Cybersecurity Lessons

This incident highlights the importance of argument sanitization and input validation. System designers should better analyze how user inputs might be interpreted. Tailscale's rapid response sets an example in vulnerability management.

## Sources covering this story

- https://tailscale.com/security-bulletins — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._