PT-2023-21719 · Tailscale · Tailscale

Ryan Belgrave · Published 2023-03-23 · Updated 2025-08-07 · CVE-2023-28436

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tailscale versions 1.34.0 through 1.38.2

Description A vulnerability in the implementation of Tailscale SSH on FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. This issue arises due to a difference in the behavior of the FreeBSD setgroups system call from POSIX, which prevents the Tailscale client from appropriately restricting groups on the host when using Tailscale SSH. As a result, when accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process is used instead of that of the user specified in Tailscale SSH access rules. Approximately 9 tailnets with 22 FreeBSD nodes may have been affected since Tailscale version 1.34.

Recommendations For Tailscale versions 1.34.0 through 1.38.2, upgrade to version 1.38.2 or later to remediate the issue. To update the local ports tree in advance, users can edit the Makefile to set PORTVERSION to 1.38.2, then run make makesum and make install. As a temporary workaround, consider restricting access to Tailscale SSH on FreeBSD devices until the issue is resolved.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-28436

GHSA-VFGQ-G5X8-G595

GO-2023-1671

Affected Products

Tailscale

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28436.json · Exploit
• https://github.com/tailscale/tailscale/security/advisories/GHSA-vfgq-g5x8-g595 · Vendor Advisory
• https://github.com/tailscale/tailscale/commit/d00c046b723dff6e3775d7d35f891403ac21a47d · Patch
• https://github.com/tailscale/tailscale/releases/tag/v1.38.2 · Patch
• https://tailscale.com/security-bulletins/#ts-2023-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28436 · Security Note
• https://osv.dev/vulnerability/GO-2023-1671 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28436 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vfgq-g5x8-g595 · Vendor Advisory
• https://github.com/tailscale/tailscale · Note
• https://twitter.com/grok/status/1953484979113226481 · Twitter Post