Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.
For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.
Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don’t need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.
Further links:
- Tailscale’s blogpost on findings and fixes, with security recommendations
- Tailscale’s security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
- Their prior investigation notes here
Tailscale ssh isn’t enabled by default and I for one don’t see the need for it.
Your choice is valid, but you’ve chosen to be responsible for adding new clients everywhere and making sure they can all connect to each other, etc. you have simpler software but more manual work, which is a valid choice if you’re up for it.
Also, I’ve never been able to understand how something exposed to the entire internet (a WG server) is considered more secure than something that only connects peers privately to each other.
The attack surfaces are nothing alike.
Even if you limit access to WG with IP blocking there’s still no comparison to something you can’t access at all from outside.
I don’t see it as there being much of a distinction from the two when you say one is public and the other isn’t, i don’t really see it that way. Wireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn’t be possible.
If you don’t need something specific that tailscale offers, then wireguard offers probably better security.
Tailscale uses wireguard, but using wireguard itself is removing all of the extra code and services (their connection facilitation layer?) that go with using tailscale.
Tailscale probably isn’t an inconsiquential amount of code added, so it can be a threat, even if it adds additional security layers (identity?). There’s more code to exploit.
Plus, wireguard is so well used directly by so many businesses, orgs and people who NEED it to be secure, and it has so many more eyes going over it that it I can’t see any way that it would be less secure.
Edit: have never used tailscale cuz i dont need it, so maybe im completely wrong about something, dont think i am tho im confident