Tailscale 团队近日披露其 SSH 服务存在安全缺陷，核心问题涉及特权升级（privilege escalation），导致授权用户在特定配置下可能获得超出本地用户配置的权限 1。针对这一风险，工程团队已着手修复大部分相关问题，并计划于2026年10月27日周二前发布修补后的客户端版本 1。
尽管存在上述安全隐患，官方基于当前评估建议暂不全面禁用 Tailscale SSH 1。为缓解风险，用户可审查访问策略，并通过设置环境变量 TS_SSH_DISABLE_FORWARDING=1 临时禁用 SSH 转发 1。后续团队还将发布详细的安全公告及技术博客文章，以说明更多调查细节与修复进展 1。
Tailscale has released an update regarding a security vulnerability in its SSH service, identifying privilege escalation as the core issue. 1 According to the company's investigation, authorized users may potentially obtain permissions exceeding those configured for local users under specific conditions. 1
The engineering team has implemented fixes for the majority of the identified problems and plans to release patched client versions by Tuesday, October 27, 2026. 1 While Tailscale states that it does not currently recommend all users disable Tailscale SSH based on their assessment, they advise reviewing access policies. 1 As a temporary mitigation measure, users can set the environment variable TS_SSH_DISABLE_FORWARDING=1 to disable SSH forwarding. 1 Detailed security advisories and technical blog posts are scheduled for future publication. 1
评论
还没有评论，欢迎留下第一条。