{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "tailscale-ssh-flaws-tailworm",
  "url": "https://patchgap.ai/incidents/tailscale-ssh-flaws-tailworm/",
  "path": "/incidents/tailscale-ssh-flaws-tailworm/",
  "json_url": "https://patchgap.ai/incidents/tailscale-ssh-flaws-tailworm.json",
  "title": "Tailscale SSH: serious bugs are now fixed in Tailscale 1.104.4. Update now.",
  "category": "network",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "tailscale"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Tailscale calls them 'serious security issues'. No score published.",
  "exploited_in_wild": "unknown",
  "exploited_note": "Tailscale's notices do not say anyone is using these bugs.",
  "exploited_source_url": "https://tailscale.com/ssh-investigation-update",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-25",
  "updated_at": "2026-10-28",
  "cves": [],
  "summary": "A researcher published bugs in Tailscale SSH, a feature of the Tailscale app. Some people who are already allowed to connect could get more power than they should. Tailscale fixed these bugs in version 1.104.4 and posted four notices about them (TS-2026-014 to TS-2026-017). Update Tailscale to 1.104.4 or newer.",
  "am_i_affected": "This is mostly about the Tailscale SSH and Tailscale Serve features. If you never turned them on, this probably does not apply to you. Still, update Tailscale to 1.104.4 or newer to be safe.",
  "action": "Update Tailscale to 1.104.4 or newer",
  "affected": [
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "windows",
    "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
    "fixed_version": "1.104.4",
    "fixed_min": "1.104.4",
    "fix_note": null,
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins"
    ],
    "check": {
     "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
     "command": "tailscale version",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://tailscale.com/download"
   },
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "macos",
    "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
    "fixed_version": "1.104.4",
    "fixed_min": "1.104.4",
    "fix_note": null,
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins"
    ],
    "check": {
     "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
     "command": "tailscale version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://tailscale.com/download"
   },
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "linux",
    "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
    "fixed_version": "1.104.4",
    "fixed_min": "1.104.4",
    "fix_note": null,
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins"
    ],
    "check": {
     "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://tailscale.com/download"
   }
  ],
  "fix_steps": [
   "Update Tailscale to version 1.104.4 or newer (the Tailscale icon > check for updates, or download it from the official site).",
   "If you use Tailscale SSH: limit who can connect to only the people and devices that need it."
  ],
  "official_patch_links": [
   {
    "label": "Tailscale: security bulletins",
    "url": "https://tailscale.com/security-bulletins"
   },
   {
    "label": "Tailscale: official download",
    "url": "https://tailscale.com/download"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://tailscale.com/ssh-investigation-update",
    "title": "Tailscale: SSH investigation and remediation update",
    "date": "2026-10-26",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://tailscale.com/security-bulletins",
    "title": "Tailscale security bulletins TS-2026-014 to TS-2026-017 (fixed in 1.104.4)",
    "date": "2026-10-27",
    "kind": "vendor",
    "official": true
   }
  ]
 }
}