Critical, CVSS 9.0GoPublished
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
GHSA-g936-7jqj-mwv8
- Affected
- Go github.com/almeidapaulopt/tsdproxy < 1.4.4-0.20260603142855-434819b4421e
- Fixed in
- 1.4.4-0.20260603142855-434819b4421e· Vendor fix available
- Issue
- A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication token to all proxied backend services. When identityHeaders is enabled (the default), tsdproxy injects x-tsdproxy-auth-token into every upstream HTTP request alongside user identity headers. This token is the same secret used by the management HTTP server to trust forwarded Tailscale identity claims. A backend that receives this token can replay it from localhost to the management port with an arbitrary x-tsdproxy-id value, bypassing Tailscale authentication entirely. The token is forwarded unconditionally: ProviderUserMiddleware always calls WhoisNewContext regardless of whether the user is authenticated. In the ReverseProxy.Rewrite function, WhoisFromContext returns ok=true even for zero-value Whois{} (unauthenticated or Funnel requests). The HeaderAuthToken is set for every request when identityHeaders=true. The attack requires the backend to reach 127.0.0.1:8080. This…
Recommended action: Upgrade to 1.4.4-0.20260603142855-434819b4421e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.