PT-2022-26154 · Tailscale · Tailscale

Emily Trau + 1 · Published 2022-11-21 · Updated 2025-08-07 · CVE-2022-41924

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Tailscale Windows client versions prior to v1.32.3

Description A vulnerability in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon tailscaled, enabling remote code execution. The local API was bound to a local TCP socket and communicated with the Windows client GUI in cleartext with no Host header verification, allowing an attacker-controlled website to rebind DNS to an attacker-controlled DNS server and make local API requests. This can lead to an attacker-controlled coordination server sending malicious URL responses, including pushing executables or installing an SMB share, which allows remote code execution on the node.

Recommendations If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.

Exploit

Fix

Origin Validation Error

CSRF

Weakness Enumeration

CWE-346

CWE-352

Related Identifiers

CVE-2022-41924

GHSA-VQP6-RC3H-83CP

GO-2022-1120

Affected Products

Tailscale

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41924.json · Exploit
• 🔥 https://emily.id.au/tailscale · Exploit
• https://tailscale.com/security-bulletins/#ts-2022-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41924 · Security Note
• https://osv.dev/vulnerability/GHSA-vqp6-rc3h-83cp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41924 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1120 · Vendor Advisory
• https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp · Note
• https://github.com/tailscale/tailscale/releases/tag/v1.32.3 · Note
• https://github.com/tailscale/tailscale · Note
• https://t.me/proxy_bar/1185 · Telegram Post
• https://t.me/rnetsec/19054 · Telegram Post
• https://t.me/thebugbountyhunter/6745 · Telegram Post
• https://twitter.com/reverseame/status/1707706037631922229 · Twitter Post
• https://twitter.com/grok/status/1953484979113226481 · Twitter Post