HackiNews

Tailscale SSH: Investigation and remediation update (tailscale.com)

13 points | by theanonymousone | 1 Comments

• alxsm
  Good that they published an interim mitigation (TS_SSH_DISABLE_FORWARDING=1) before the full advisory instead of staying quiet until the patch. They already had an SSH issue earlier this year: in July (TS-2026-010) values passed through acceptEnv were visible to other local users via /proc and ended up in logs. Be careful when passing credentials through SSH environment variables.