TS-2026-013

Description: Leaked private keys for eMudhra TLS intermediate certificates What happened? To validate TLS connections, the Tailscale client and Tailscale servers rely on the host operating system's root certificate store (for example, ca-certificates on Linux). Our control plane certificates are signed by Let's Encrypt, so the Tailscale client also embeds Let's Encrypt CA certificates, in case they're absent from your system's certificate store. Tailscale accepts any TLS connection which is signed by a certificate trusted by the system certificate store. Eight TLS intermediate certificates owned by eMudhra Limited have been compromised. This would allow an attacker to create new certificates for websites they do not control, and these certificates would be trusted by any device that trusts the compromised certificates. Users connecting to the malicious website would receive no warning about incorrect certificates. Tailscale v1.104.2 or later includes Go 1.27.3, which explicitly distrusts the compromised certificates, even if they are still included in your system certificate store. Tailscale's internal services have been updated to distrust the compromised certificates, by updating to Go 1.27.3 and updating the host certificate stores. What was the impact? An attacker could create TLS certificate for domains they did not own. Devices would accept these TLS certificates as valid and connect to the attacker-controlled website. Who was affected? This issue affects any device running on an operating system where the compromised eMudhra intermediate root certificates remain in the system certificate store. Standard Tailscale mesh traffic between nodes (WireGuard end-to-end encryption using Tailscale node keys) is not affected, as node-to-node data plane traffic does not rely on public Web PKI or system certificate stores. What do I need to do? Update to Tailscale v1.104.2 or later.