Tailscale v1.104.4 修复 SSH 越权访问与 DoS 漏洞

Note: v1.104.3 was an internal-only release.

All Platforms

• Fixed: Tailscale SSH performs Unix socket forwarding on behalf of the authenticated user rather than as root, preventing authorized peers from using local and remote forwarding to reach root-only Unix sockets such as the Docker socket or the tailscaled local API. This fix addresses a security vulnerability described in TS-2026-014.
• Fixed: Tailscale SSH bounds the memory used for session handling and releases it when the peer disconnects, preventing denial of service through unbounded memory growth in tailscaled from continuous window-change messages and environment variable appends. This fix addresses a security vulnerability described in TS-2026-015.
• Fixed: Tailscale Serve restricts TCP forwards to Unix socket backends and revalidates backend paths on each connection, preventing access to privileged Unix sockets such as the tailscaled local API socket. This fix addresses a security vulnerability described in TS-2026-016.
• Fixed: Tailscale Serve derives per-request capabilities from the request context rather than from a context shared across all HTTP/2 streams, preventing Tailscale-App-Capabilities values from one mount from being sent with requests for another. This fix addresses a security vulnerability described in TS-2026-017.