libtailscale could identify the wrong connection
The flaw affected applications embedding libtailscale, not standard Tailscale clients. Check the library and any decisions based on peer addresses.
Vendor bulletin:
Using ordinary Tailscale does not make this your bug. For custom applications, ask the developer to check the embedded library.
What happened?
Tailscale published TS-2026-012 on 13 October. Its embedded library, libtailscale, could associate a connection with another peer’s address. The same underlying bug could also disrupt unrelated descriptors inside the application.
This matters when an application uses the returned address to grant access or attribute activity. The bulletin does not establish that customer data was accessed.
Who is outside this scope?
The vendor explicitly excludes the standard Tailscale client and deployments based on tailscaled. Tailscale installed on a company laptop is not the same component as libtailscale embedded inside custom software.
What should your developer check?
- Does our application embed libtailscale or its language bindings?
- Is it using version 0.2.0 or newer? TailscaleKit users should rebuild from current libtailscale source, following the vendor’s instructions.
- Did the application use returned peer addresses for access or accounting decisions? If so, review decisions and logs from the affected period.
Avoid a vague request to “update Tailscale”. Ask which component was checked and which version the application actually runs. That answer determines whether this particular advisory applies.
Sources and fixes
Original sources and instructions you can check yourself.
- Original sourceTailscale · TS-2026-012: original bulletintailscale.com · Checked 26 October 2026
- Fix or instructionsTailscale · TS-2026-012: remediation instructionstailscale.com · Checked 26 October 2026
- ContextTailscale · official libtailscale repositorygithub.com · Checked 26 October 2026