{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2026-005",
  "link": "https://tailscale.com/security-bulletins/#ts-2026-005",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2026-005",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Wed, 03 Jun 2026 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale Serve Unix socket proxy targets were not restricted to \u003ccode\u003eroot\u003c/code\u003e, allowing a non-root operator to proxy privileged sockets.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-serve\"\u003eTailscale Serve\u003c/a\u003e can proxy incoming connections to local backends, including Unix domain sockets configured as \u003ccode\u003eproxy\u003c/code\u003e targets (for example, \u003ccode\u003eproxy: unix:/var/run/docker.sock\u003c/code\u003e). A non-root local user configured as the \u003ca href=\"https://tailscale.com/docs/reference/tailscale-cli\"\u003eTailscale operator\u003c/a\u003e can write Serve configuration through the LocalAPI.\u003c/p\u003e\n\u003cp\u003eTailscale restricts the ability to specify filesystem paths as Serve targets to the root user to prevent privilege escalations, however this check did not cover Unix socket proxy targets. A non-root operator could therefore have the \u003ccode\u003etailscaled\u003c/code\u003e process running as root proxy to a privileged Unix socket, bypassing the filesystem permissions that would otherwise deny them access.\u003c/p\u003e\n\u003cp\u003eTailscale now restricts Unix socket proxy targets to the \u003ccode\u003eroot\u003c/code\u003e user, matching the requirement already applied to filesystem handlers.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.98.9 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eA non-root user configured as the Tailscale operator could cause the \u003ccode\u003etailscaled\u003c/code\u003e process running as \u003ccode\u003eroot\u003c/code\u003e to connect to privileged Unix sockets they could not otherwise access.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eLinux/Unix hosts running Tailscale Serve where a non-root local user was configured as the Tailscale operator and privileged Unix sockets (such as Docker, containerd, or CRI sockets) were present.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale Serve, upgrade to Tailscale version 1.98.9 or newer.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank Tim Sageser (\u003ca href=\"https://dtrsecurity.com\"\u003edtrsecurity\u003c/a\u003e) for reporting this issue.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale Serve Unix socket proxy targets were not restricted to \u003ccode\u003eroot\u003c/code\u003e, allowing a non-root operator to proxy privileged sockets.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-serve\"\u003eTailscale Serve\u003c/a\u003e can proxy incoming connections to local backends, including Unix domain sockets configured as \u003ccode\u003eproxy\u003c/code\u003e targets (for example, \u003ccode\u003eproxy: unix:/var/run/docker.sock\u003c/code\u003e). A non-root local user configured as the \u003ca href=\"https://tailscale.com/docs/reference/tailscale-cli\"\u003eTailscale operator\u003c/a\u003e can write Serve configuration through the LocalAPI.\u003c/p\u003e\n\u003cp\u003eTailscale restricts the ability to specify filesystem paths as Serve targets to the root user to prevent privilege escalations, however this check did not cover Unix socket proxy targets. A non-root operator could therefore have the \u003ccode\u003etailscaled\u003c/code\u003e process running as root proxy to a privileged Unix socket, bypassing the filesystem permissions that would otherwise deny them access.\u003c/p\u003e\n\u003cp\u003eTailscale now restricts Unix socket proxy targets to the \u003ccode\u003eroot\u003c/code\u003e user, matching the requirement already applied to filesystem handlers.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.98.9 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eA non-root user configured as the Tailscale operator could cause the \u003ccode\u003etailscaled\u003c/code\u003e process running as \u003ccode\u003eroot\u003c/code\u003e to connect to privileged Unix sockets they could not otherwise access.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eLinux/Unix hosts running Tailscale Serve where a non-root local user was configured as the Tailscale operator and privileged Unix sockets (such as Docker, containerd, or CRI sockets) were present.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale Serve, upgrade to Tailscale version 1.98.9 or newer.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank Tim Sageser (\u003ca href=\"https://dtrsecurity.com\"\u003edtrsecurity\u003c/a\u003e) for reporting this issue.\u003c/p\u003e"
  },
  "title": "TS-2026-005",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2026-005"
  }
}