TS-2025-005

Description: Logging of MDM-provided auth keys What happened? A change in Tailscale version 1.84.0 on macOS and iOS caused all MDM-provided configuration values to be logged and uploaded to the Tailscale log server. One of the possible MDM values is an auth key used to automatically register the node. This resulted in the Tailscale log server storing user auth keys along with other client logs. The logs collected by the Tailscale log server are only accessible to Tailscale employees, so no auth keys were leaked to potential attackers. Tailscale version 1.86.4 redacts the auth key, and other textual values, before logging them. What was the impact? MDM-provisioned auth keys were uploaded to the Tailscale log server. No keys have leaked outside of Tailscale infrastructure. Auth keys provided on the CLI or using environment variables were never logged. The impact depends on the type of auth key used: One-off auth keys are used and invalidated when the node is registered; there is no risk to your tailnet Reusable auth keys could be used again to register nodes if stolen Pre-signed auth keys for Tailnet Lock are like reusable auth keys, but can also register nodes that don't need to be signed by another signing node in the tailnet Who was affected? Customers using MDM to distribute auth keys, with macOS and iOS clients running Tailscale versions between 1.84.0 and 1.86.2, are affected. What do I need to do? If you don't use MDM to distribute auth keys to your devices, no action is needed. If you do distribute auth keys with MDM, upgrade all macOS and iOS nodes to Tailscale version 1.86.4 or later. Additionally, if you distribute reusable auth keys, or pre-signed auth keys for Tailnet Lock, we recommend that you rotate these keys.