CVE-2026-107060 in Tailscale
Summary
by MITRE • 10/29/2026
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Tailscale, specifically within the build associated with version code 297862600, represents a critical failure in access control mechanisms that governs how users interact with their respective Virtual Private Network (VPN) environments. This flaw stems from an insecure permission model where the application fails to adequately verify whether the authenticated user initiating a configuration change possesses the requisite administrative privileges for the target node or network segment. In a properly secured system, any modification to VPN topology, device policies, or access controls must be strictly bound to the identity of the requester and validated against predefined role-based access control lists. However, in this instance, the authorization logic is either missing or incorrectly implemented, allowing an attacker who has obtained valid credentials for one account to manipulate settings belonging to another user's infrastructure without triggering appropriate authentication challenges or permission denials.
From a technical perspective, this issue classifies as a Broken Access Control vulnerability, which aligns with CWE-284 in the Common Weakness Enumeration taxonomy. The core defect lies in the server-side validation of requests; when an API call is made to update VPN configurations, such as adding or removing devices from a tailnet or altering access control rules, the backend service does not sufficiently check if the session token corresponds to an entity with ownership or admin rights over the affected resources. This oversight enables privilege escalation at the application level, where a standard user can effectively assume administrative capabilities by exploiting the lack of object-level authorization checks. The vulnerability likely affects both direct node management and broader network policy adjustments, as these operations typically share underlying permission structures that are not properly segmented between different tenant accounts or organizational units within the Tailscale ecosystem.
The operational impact of this flaw is severe, potentially leading to a complete compromise of the confidentiality, integrity, and availability of affected networks. An unauthorized attacker can make arbitrary changes to another user's VPN configurations, which may include adding malicious nodes to the network, thereby gaining persistent access to internal resources that were previously isolated. Furthermore, by altering preferences or disabling security features such as device verification or key rotation policies, an adversary can weaken the overall security posture of the target organization. This could facilitate lateral movement within the corporate network, data exfiltration through unauthorized tunnels, or even a denial-of-service condition if critical routing rules are deleted or corrupted. The ability to modify configurations arbitrarily undermines trust in the identity-based perimeter that Tailscale is designed to provide, effectively neutralizing one of its primary security benefits.
To mitigate this risk, immediate action should be taken by upgrading to a patched version of Tailscale where these permission checks have been corrected and validated against industry best practices for secure API design. Organizations relying on affected versions should review their audit logs for any anomalous configuration changes that occurred after the vulnerability was introduced but before the patch was applied. It is also advisable to enforce strict multi-factor authentication across all user accounts to reduce the likelihood of credential compromise, which serves as the primary vector for exploiting this access control flaw. Additionally, implementing principle of least privilege in administrative roles and regularly rotating API keys can help limit the blast radius if such a vulnerability were to be exploited again. Continuous monitoring of network topology changes through automated alerting systems will also aid in detecting unauthorized modifications early, providing an additional layer of defense against misconfigurations resulting from this or similar vulnerabilities.