Researcher publishes 11 unpatched Tailscale flaws, skipping coordinated disclosure
basedjensen · x · 2026-10-25
Researcher Erica Windisch (Cyberdione Labs) skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. Her report says Tailscale SSH race conditions let one compromised device gain root on other servers and add a rogue node. The note criticizes Tailscale/headscale design for moving away from security-in-depth: removing authentication layers and replacing privilege-separated daemons like OpenSSH with a highly privileged process, plus broader-than-advertised network boundaries. She argues rapid public awareness will expedite remediation and says all research ran on her own systems, unaffiliated with Tailscale Inc.
More from Infra
- Burned $5,300 of AI tokens in 30 days on a $300 subscription plan — theteknosaur · 2026-10-26
- Jane Street, Hudson River Trading build data centers and back chip startups for AI — The Decoder · 2026-10-26
- Hamster wheel 'powers' local AI in a hilariously polished livestream-style setup — Sad_Measurement_7502 · 2026-10-26
- $10-12K build for local agentic coding: 1x 5090 vs 4x 3090 vs Mac Studio M5 Ultra — Shadmelor · 2026-10-26
- $1.5M local inference cluster running 240+ kWh/day is the new 'lottery winner' flex — TheZachMueller · 2026-10-26
- Gartner: 80% of neoclouds to cease independent ops by 2030, $4T at write-down risk — rohanpaul_ai · 2026-10-26