Home / Companies / Tailscale / Blog / Post Details
Content Deep Dive

Action required: Upgrade Windows clients to v1.32.3

Blog post from Tailscale

Post Details
Company
Date Published
Author
David Crawshaw
Word Count
305
Language
-
Hacker News Points
-
Summary

Tailscale has identified security vulnerabilities in its Windows client that allow a malicious website to alter the Tailscale daemon configuration and access information through the Tailscale local and peer APIs. These vulnerabilities, which involve DNS rebinding attacks due to cleartext communication and lack of Host header verification between the local API and the Windows client GUI, can potentially enable attackers to change the coordination server and access environment variables. Although there is no evidence of these vulnerabilities being exploited, users are urged to upgrade their Windows clients to version 1.32.3 or later, or the unstable version 1.33.257 or later, to ensure protection. Affected users have been notified via email, and administrators can monitor impacted devices through the admin console. Instructions for obtaining the latest stable release are provided for users who may not yet see the update available on their devices.