{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2024-006",
  "link": "https://tailscale.com/security-bulletins/#ts-2024-006",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2024-006",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Wed, 22 May 2024 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailnet SSO provider migration impacting invited users\u003c/p\u003e\n\u003ch5\u003eWhat happened?\u003c/h5\u003e\n\u003cp\u003eWhen tailnets are created, they are associated with an \u003ca href=\"https://tailscale.com/kb/1013/sso-providers\"\u003eSSO\nprovider\u003c/a\u003e such as Google or Microsoft, requiring all members\nof the tailnet to authenticate using that provider. In addition, Tailscale also\nsupports inviting \u003ca href=\"https://tailscale.com/kb/1271/invite-any-user\"\u003eexternal users\u003c/a\u003e to tailnets to allow\nsharing with contractors, friends, or other collaborators who may use a\ndifferent SSO provider than that of the inviting tailnet to log in to\nTailscale.\u003c/p\u003e\n\u003cp\u003eCustomers with an existing tailnet who wish to use a different SSO provider can\nrequest to migrate via customer support. The internal tool used to perform these\nmigrations previously migrated the SSO provider for\n\u003cem\u003eall members\u003c/em\u003e of a tailnet, including those of invited external members.\u003c/p\u003e\n\u003cp\u003eWe fixed this internal tool to migrate direct tailnet members, excluding invited\nmembers on May 20, 2024.\u003c/p\u003e\n\u003cp\u003eWe reverted the erroneous SSO provider changes and notified affected\nusers on May 23, 2024.\u003c/p\u003e\n\u003ch5\u003eWho was affected?\u003c/h5\u003e\n\u003cp\u003e55 users were invited external members of tailnets whose SSO provider was\nsubsequently migrated prior to May 20, 2024. We have notified the security\ncontacts for the tailnets where users were affected by this incident.\u003c/p\u003e\n\u003ch5\u003eWhat was the impact?\u003c/h5\u003e\n\u003cp\u003eUsers whose SSO providers were erroneously migrated would have been\nunable to log in to Tailscale during this time, as their SSO source\nwould differ from the one on record.\u003c/p\u003e\n\u003ch5\u003eWhat do I need to do?\u003c/h5\u003e\n\u003cp\u003eNo action is needed at this time.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailnet SSO provider migration impacting invited users\u003c/p\u003e\n\u003ch5\u003eWhat happened?\u003c/h5\u003e\n\u003cp\u003eWhen tailnets are created, they are associated with an \u003ca href=\"https://tailscale.com/kb/1013/sso-providers\"\u003eSSO\nprovider\u003c/a\u003e such as Google or Microsoft, requiring all members\nof the tailnet to authenticate using that provider. In addition, Tailscale also\nsupports inviting \u003ca href=\"https://tailscale.com/kb/1271/invite-any-user\"\u003eexternal users\u003c/a\u003e to tailnets to allow\nsharing with contractors, friends, or other collaborators who may use a\ndifferent SSO provider than that of the inviting tailnet to log in to\nTailscale.\u003c/p\u003e\n\u003cp\u003eCustomers with an existing tailnet who wish to use a different SSO provider can\nrequest to migrate via customer support. The internal tool used to perform these\nmigrations previously migrated the SSO provider for\n\u003cem\u003eall members\u003c/em\u003e of a tailnet, including those of invited external members.\u003c/p\u003e\n\u003cp\u003eWe fixed this internal tool to migrate direct tailnet members, excluding invited\nmembers on May 20, 2024.\u003c/p\u003e\n\u003cp\u003eWe reverted the erroneous SSO provider changes and notified affected\nusers on May 23, 2024.\u003c/p\u003e\n\u003ch5\u003eWho was affected?\u003c/h5\u003e\n\u003cp\u003e55 users were invited external members of tailnets whose SSO provider was\nsubsequently migrated prior to May 20, 2024. We have notified the security\ncontacts for the tailnets where users were affected by this incident.\u003c/p\u003e\n\u003ch5\u003eWhat was the impact?\u003c/h5\u003e\n\u003cp\u003eUsers whose SSO providers were erroneously migrated would have been\nunable to log in to Tailscale during this time, as their SSO source\nwould differ from the one on record.\u003c/p\u003e\n\u003ch5\u003eWhat do I need to do?\u003c/h5\u003e\n\u003cp\u003eNo action is needed at this time.\u003c/p\u003e"
  },
  "title": "TS-2024-006",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2024-006"
  }
}