Tailscale’s certificate update: what does it fix?
Tailscale 1.104.2 distrusts compromised eMudhra certificates. This certificate update is not a fix for the later Tailworm research findings.
Patch release:
Apply the certificate fix, but do not treat it as evidence that every other Tailscale security issue has been resolved.
What changed on 21 October?
Tailscale bulletin TS-2026-013 concerns leaked private keys for eMudhra intermediate certificates. An attacker with such a key could create certificates for domains they do not control, undermining trust in the other end of a TLS connection.
Tailscale 1.104.2 includes Go 1.27.3 and explicitly rejects the compromised certificates even if the operating system still trusts them. The vendor recommends 1.104.2 or later.
Was Tailscale’s encryption broken?
That is not what this bulletin says. The vendor distinguishes public certificate trust from ordinary WireGuard traffic between devices: the latter does not depend on the same public certificate system.
What should you check?
Ask your network administrator to identify deployed Tailscale versions and arrange the required update. A newer installation does not need to be downgraded to 1.104.2.
Also ask which advisory the update addresses. TS-2026-013 is not a Tailworm fix. The later Tailworm report tested version 1.104.2 itself. Keep the certificate issue and those research findings separate when reviewing risk and deciding what additional checks are needed.
Sources and fixes
Original sources and instructions you can check yourself.
- Original sourceTailscale · TS-2026-013: certificate bulletintailscale.com · Checked 26 October 2026
- Fix or instructionsTailscale · 1.104.2 release notes, 21 Octobertailscale.com · Checked 26 October 2026
- ContextTailworm · researcher report and tested versionwww.tailworm.com · Checked 26 October 2026