Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

tailscale.com/cmd

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.8GoPublished

    Tailscale daemon is vulnerable to information disclosure via CSRF

    CVE-2022-41925 · GHSA-qccm-wmcq-pwr6

    Affected
    • Go tailscale.com/cmd < 1.32.3
    Fixed in
    1.32.3· Vendor fix available
    Issue
    A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. Affected platforms: All Patched Tailscale client versions: v1.32.3 or later, v1.33.257 or later (unstable) What happened? In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. Who is affected? All Tailscale clients prior to version v.1.32.3 are affected. What should I do? Upgrade to v1.32.3 or later to remediate the issue. What is the impact? An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale…

    Recommended action: Upgrade to 1.32.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →