Tailscale SSH Turned A Hyphenated Username Into A Root Login
Tailscale SSH versions before 1.98.9 passed usernames straight to Linux's getent, so '-i' was read as a command flag, not a name.
- The username '-i' reached Linux's getent(1) as its --no-idn flag, not as a name.
- getent then printed the full password file, starting with the root account entry.
- The flaw defeated autogroup:nonroot ACLs meant to block root; version 1.98.9 fixes it.
Why it matters: A permission rule is worth nothing if the software beneath it still trusts raw user input.
Tailscale Security Bulletins (TS-2026-009) ↗ · Jul 15, 20267/15/26 · ✓ Checked✓ Check