Anatomy of a Bypass: How a Small Argument Parsing Bug Granted Root Access in Tailscale SSH

Hey everyone, Alex here. Welcome back to another edition of Coding with Alex on sysseder.com.

If you're anything like me, you’ve probably spent the last couple of years slowly replacing your traditional, clunky VPN setups and SSH key distribution pipelines with Tailscale. Specifically, Tailscale SSH has been a godsend. It promises to let us manage SSH access using our existing Tailscale identity control plane—no more manual authorized_keys synchronization, no more hunting down rogue public keys. You just authenticate via your identity provider, and boom: secure, end-to-end encrypted terminal access to your infrastructure.

But security is a game of millimeters. On March 5, 2026, Tailscale published a security advisory—TS-2026-009 (CVE-2026-XXXX)—that sent a shiver down the spine of systems administrators and DevOps engineers alike. The vulnerability details an insecure argument-handling bug in the Tailscale SSH daemon. Under the right (or rather, wrong) conditions, this bug allowed an authenticated but restricted user to completely bypass target user restrictions and execute commands as root.

Today, we are going to dive deep into the mechanics of this vulnerability. We will look at how modern SSH implementations handle commands, how argument parsing can go subtly wrong, and the practical engineering lessons we must take away to prevent these classes of bugs in our own Go and system-level applications.

Understanding the Tailscale SSH Architecture

To understand what went wrong, we first need to understand how Tailscale SSH differs from your standard OpenSSH daemon (sshd).

In a standard OpenSSH deployment, when you run ssh user@host "command", the SSH daemon spawns a shell for user and passes the command string to that shell. OpenSSH is a monolithic, highly privileged C program that relies heavily on OS-level privilege separation (the monitor process/child process model).

Tailscale SSH is different. It is written in Go and runs directly inside the tailscaled daemon. When an SSH connection arrives over your Tailscale tailnet, tailscaled intercepts the connection, evaluates your Tailscale ACLs (Access Control Lists) to see if you are allowed to access that machine as the requested user, and then spawns the user’s shell directly.

Crucially, Tailscale allows administrators to define highly granular ACLs. For example, your ACL policy might state:

• Developers can SSH into production servers, but only as the low-privilege app-reader user.
• Only the DevOps Lead can SSH into production servers as root.

The vulnerability bypassed this entire boundary. If you had permission to access a machine as any user (say, the restricted app-reader), you could craft a specific payload that tricked the Tailscale SSH daemon into spawning your shell or command as root. Let’s look at how that happened.

The Vulnerability: Insecure Argument Handling

When you initiate an SSH session that executes a command directly (non-interactive session), the SSH client sends an execution request containing the command string. For example:

ssh user@server "cat /var/log/nginx/access.log"

Under the hood, the SSH protocol sends an exec channel request. The payload of this request is a single string: "cat /var/log/nginx/access.log".

To execute this on a Unix-like system, the SSH daemon must pass this string to the user's login shell (usually /bin/sh or /bin/bash) using the -c flag. The system execution call roughly translates to:

/bin/bash -c "cat /var/log/nginx/access.log"

The security bug in TS-2026-009 lies in how the Tailscale SSH daemon processed, sanitized, and tokenized arguments before spawning the shell process on behalf of the user, particularly when evaluating which OS user context to apply to the spawned process.

The "Double-parsing" Trap

In Go, when you want to execute an external command as a specific user, you typically manipulate the SysProcAttr of an exec.Cmd struct to set the Credential field (which contains the UID and GID).

Before doing this, Tailscale SSH needed to determine the target environment, shell, and arguments. The vulnerability arose because the daemon performed a multi-pass parsing of the command arguments. The daemon parsed the SSH request payload to make authorization and routing decisions, and then parsed it again (or passed it unsanitously) when invoking the system shell.

By injecting specific control characters, escape sequences, or unexpected shell arguments into the command string, an attacker could exploit a discrepancy between how Tailscale's Go-based authorization logic parsed the arguments and how the underlying system shell interpreted them.

Imagine a simplified representation of the flawed logic in Go:

// CONCEPTUAL FLUSHED LOGIC - FOR ILLUSTRATIVE PURPOSES
func handleSSHRequest(ctx *sshContext, cmdStr string) error {
    // 1. Authorize based on the requested user in the SSH context
    targetUser := ctx.RequestedUser() // e.g., "app-reader"
    
    if !aclPermitted(ctx.Actor(), targetUser, ctx.Host()) {
        return errors.New("Access Denied")
    }

    // 2. Parse the command string to check for restricted commands
    // Bug: If cmdStr contains carefully crafted arguments (e.g. involving su, sudo, or shell flags),
    // it could trick the daemon's internal parsing while being executed literally.
    
    // 3. Spawning the shell
    shell := getShellForUser(targetUser) // returns "/bin/bash"
    
    // If the parser was tricked into altering the execution execution path
    // or injecting arguments that escape the intended UID boundary:
    cmd := exec.CommandContext(ctx, shell, "-c", cmdStr)
    cmd.SysProcAttr = &syscall.SysProcAttr{
        Credential: &syscall.Credential{Uid: getUid(targetUser), Gid: getGid(targetUser)},
    }
    
    return cmd.Run()
}

In TS-2026-009, the argument-handling parser was vulnerable to parameter pollution or argument injection. An attacker could pass arguments that bypassed the Go-level restriction checks but were evaluated by the terminal spawn mechanism in a way that elevated execution to the root context, or executed commands outside of the constrained UID context altogether.

The Dangerous Synergy of Shells and setuid

To make matters worse, system shells (like bash, sh, and zsh) have incredibly complex behaviors when they start up. They read system-wide profiles (/etc/profile), user-specific profiles (~/.bashrc), and handle environment variables in highly complex ways.

If an argument parsing bug allows an attacker to inject environment variables or flags directly into the shell execution line (e.g., passing flags like --init-file or manipulating LD_PRELOAD through environment passing), they can force the shell to execute arbitrary code before dropping privileges, or leverage setuid binaries on the host system to escalate directly to root.

In Tailscale's case, because the tailscaled daemon itself runs as root (in order to manage system routing tables and WireGuard interfaces), any slip-up in dropping privileges during child process spawning is catastrophic. If the daemon fails to safely and atomically drop privileges to the target user before executing the command, the command executes as root.

The Fix: Robust Tokenization and Sandboxing

Tailscale addressed TS-2026-009 by rewriting how arguments are sanitized and parsed before they are passed to the system shell. The core of the fix relies on:

1. Strict Whitespace and Quote Tokenization: Ensuring that arguments are not double-evaluated by both the Go runtime and the shell.
2. Rigid UID/GID Dropping: Ensuring that the process's credentials (UID, GID, and supplementary groups) are dropped explicitly and atomically at the OS level before any user-supplied command strings are parsed or executed.
3. Input Sanitization: Rejecting SSH commands that contain dangerous shell metacharacters or flags that could alter shell execution behavior.

Let's look at how we can implement a safe command execution pattern in Go that avoids these kinds of pitfalls.

package main

import (
	"context"
	"os/exec"
	"syscall"
)

// SafeExecuteCommand executes a command string as a specific low-privilege user
// by strictly passing it to a shell without allowing argument pollution.
func SafeExecuteCommand(ctx context.Context, targetUid, targetGid uint32, userCommand string) error {
	// Instead of dynamically building complex arguments, we run a static shell path
	// and pass the user command strictly as a single string argument to "-c"
	shellPath := "/bin/sh"
	
	cmd := exec.CommandContext(ctx, shellPath, "-c", userCommand)
	
	// Ensure we explicitly drop privileges to the target user before executing anything
	cmd.SysProcAttr = &syscall.SysProcAttr{
		Credential: &syscall.Credential{
			Uid:         targetUid,
			Gid:         targetGid,
			Groups:      []uint32{targetGid}, // Don't forget to restrict supplementary groups!
			NoNewPrivs:  true,                // Prevent the process from gaining new privileges via setuid binaries
		},
	}
	
	// Clear dangerous environment variables that could alter shell behavior
	cmd.Env = []string{
		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
		"HOME=/tmp",
		"USER=restricted",
	}

	return cmd.Run()
}

Note the use of NoNewPrivs: true in the SysProcAttr. This is a crucial Linux security feature. It ensures that the spawned process (and any of its children) can never gain privileges via setuid or setgid binaries (like sudo or passwd). Even if the user finds a way to execute a privileged binary, the kernel will refuse to elevate the execution context.

Lessons for Developers

As software engineers, TS-2026-009 offers several critical takeaways for building secure systems:

1. Beware of "Argument Injection"

Whenever you are passing user-controlled inputs to system-level commands, you are at risk. Avoid passing raw strings to shell interpreters whenever possible. If you must use a shell, treat the shell as a black box and pass arguments using safe APIs (like Go’s exec.Command slice architecture) rather than string concatenation.

2. The Principle of Least Privilege in Go Daemons

If your daemon runs as root (like many DevOps, networking, or monitoring agents do), you must design a strict, isolated boundary where privilege dropping occurs. Treat the code that executes as root as a highly restricted, minimal surface area. The moment you need to do something on behalf of a user, drop privileges immediately, atomically, and permanently.

3. Defense in Depth: Use NoNewPrivs

If you are writing Go code that runs on Linux and spawns user-controlled processes, always set NoNewPrivs: true in your SysProcAttr. It is a simple, single-line configuration change that completely mitigates a massive category of privilege escalation attacks.

Wrapping Up: Time to Patch

Tailscale has already released updates addressing TS-2026-009. If you are running Tailscale SSH in your infrastructure, you should update your tailscaled daemons to the latest stable release immediately.

Security bugs in tools we trust can be alarming, but they also serve as incredible learning opportunities. They remind us that the boundary between secure and vulnerable often comes down to how we handle strings, parse arguments, and interact with the operating system APIs.

What are your thoughts on Tailscale SSH's architecture? Have you ever had to write secure privilege-dropping code in Go or C? Let me know in the comments below!

Until next time, keep your code clean, your dependencies updated, and your systems secure. Happy coding!