According to CoinMeta, Tailscale has been exposed to 11 security issues. Security researcher Erica Windisch pointed out in a report released on October 25th that attackers only need to control a device that has been authorized to access the target server through Tailscale SSH in order to further gain root permissions on the server. The vulnerability stems from permission isolation; the Tailscale backend operates under the identity of root, and some SSH forwarding operations also utilize these permissions. The researcher bypassed the restrictions for regular accounts through Unix and socket, successfully obtaining root server permissions. In addition, the attack chain also intercepted the device registration key and managed to add a forged server to the test network where Tailnet and lock were not enabled. Tailscale, the vice president of engineering at Tailscale, acknowledged that the team has discovered the issue of permission overstepping after authorization, but has not yet confirmed all the conclusions of the research report. The engineering team has submitted several SSH modification plans in GitHub, aiming to make forwarding operations use the permissions of the actual logging-in users instead of directly executing them through the root process. However, the relevant fixes have not yet been released in a formal version.