Vendor scorecard

Tailscale

Tailscale security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.

CPE: tailscale

Product families

Open in latest

Inferred — see methodology

Last disclosure

Mar 23, 2023

Product categories

1 tracked

CVE volume, severity mix and the inferred latest shipping version per category.

Category	CVEs	Volume	Severity mix	Open	Inferred latest
Tailscale Client / CoordinationSecure Remote Access / VPN · Zero-Trust / ZTNAtailscale	3			0	1.38.2MED

Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Tailscale total above.

Disclosure trend

12 months

Cumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.

Critical
High
Medium
Low

Recent CVEs

3 shown

Most recently published, newest first. Each ID links to its NVD record.

Recent CVEs affecting Tailscale
CVE	Severity	CVSS	Summary	Published
CVE-2023-28436(opens NVD record)	Medium	5.7	Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue.	Mar 23, 2023
CVE-2022-41925(opens NVD record)	High	8.8	A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.	Nov 23, 2022
CVE-2022-41924(opens NVD record)	Critical	9.6	A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server. An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.	Nov 23, 2022

3 CVEs · 1 product families