Tailscale SSH security reports (pre-disclosure)

Three independent findings from a source audit of tailscaled v1.102.4 (3caf7d9e7dcaba589cfc58beda596929733e4fea) and gliderssh v0.3.4-0.20260716005906 (1a0f895faf28), shared privately with a Tailscale contact on 2026-10-24:

1. TOCTOU in Unix-socket forwarding — bypasses the TS-2026-004 fix, root access to privileged sockets
2. Unrestricted root-dialed TCP forwarding (direct-tcpip) — no PermitOpen equivalent
3. The TS-2026-006 fix (digit-only username rejection) was silently removed after v1.102.0

Update 2026-10-25: the researcher-led audit that prompted this has been published — tailworm.com (Erica Windisch, Cyberdione Labs). Her findings 1–3 independently confirm report 1’s class and go considerably further (systemd D-Bus root shell, localapi authkey capture, rogue node enrollment). Reports 2 and 3 above are not covered in her report and remain independent findings.

— psn

• 2026/10/24 Report 1: TOCTOU in Tailscale SSH Unix-socket forwarding bypasses the TS-2026-004 fix (root access to privileged sockets)
• 2026/10/24 Report 2: Tailscale SSH local TCP forwarding dials arbitrary destinations as root (no PermitOpen equivalent)
• 2026/10/24 Report 3: the TS-2026-006 fix (digit-only username rejection) was silently removed after v1.102.0