Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Summary
Tailscale has released version 1.104.4 to address vulnerabilities in its integrated SSH server. These flaws could allow an attacker to access sensitive services and files on other servers, which should only be accessible by the root user.
IFF Assessment
The discovered vulnerabilities in Tailscale's SSH server could allow unauthorized root access to other servers, posing a significant risk to defenders.
Severity
The CVSS score is estimated based on the potential for an attacker to gain root access to other servers through flaws in network connection forwarding, which could lead to significant unauthorized access and data compromise.
Defender Context
Defenders should be aware of this vulnerability in Tailscale's SSH server, as it could allow attackers to pivot from a compromised device to other critical servers within a network. Prompt patching of Tailscale is essential to prevent unauthorized root access.