CVE-2022-41925
Tailscale daemon is vulnerable to information disclosure via CSRF
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Tailscale daemon is vulnerable to information disclosure via CSRF
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
- Record
CVE-2022-41925- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2022-7411
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
- Record
EUVD-2022-7411- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qccm-wmcq-pwr6
Tailscale daemon is vulnerable to information disclosure via CSRF
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables.
Affected platforms: All Patched Tailscale client versions: v1.32.3 or later, v1.33.257 or later (unstable)
What happened?
In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables.
Who is affected?
All Tailscale clients prior to version v.1.32.3 are affected.
What should I do?
Upgrade to v1.32.3 or later to remediate the issue.
What is the impact?
An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop.
An attacker with access to the peer API who sent a malicious file via Taildrop which was accessed while it was loading could use this to gain access to the local API, and remotely execute code.
There is no evidence of this vulnerability being purposefully triggered or exploited.
Credits
We would like to thank Emily Trau and Jamie McClymont (CyberCX) for reporting this issue. Further detail is available in their blog post.
References
For more information
If you have any questions or comments about this advisory, contact Tailscale support.
- Record
GHSA-qccm-wmcq-pwr6- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-200, CWE-352
- Updated
- 2026-11-02
NVD
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
- Record
CVE-2022-41925- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-41925
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
- Record
ALPINE-CVE-2022-41925- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Tailscale daemon is vulnerable to information disclosure via CSRF
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
- Record
CVE-2022-41925- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-qccm-wmcq-pwr6
Tailscale daemon is vulnerable to information disclosure via CSRF
A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables.
Affected platforms: All Patched Tailscale client versions: v1.32.3 or later, v1.33.257 or later (unstable)
What happened?
In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables.
Who is affected?
All Tailscale clients prior to version v.1.32.3 are affected.
What should I do?
Upgrade to v1.32.3 or later to remediate the issue.
What is the impact?
An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop.
An attacker with access to the peer API who sent a malicious file via Taildrop which was accessed while it was loading could use this to gain access to the local API, and remotely execute code.
There is no evidence of this vulnerability being purposefully triggered or exploited.
Credits
We would like to thank Emily Trau and Jamie McClymont (CyberCX) for reporting this issue. Further detail is available in their blog post.
References
For more information
If you have any questions or comments about this advisory, contact Tailscale support.
- Record
GHSA-qccm-wmcq-pwr6- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-200, CWE-352
- Updated
- 2026-11-02
OSVGO-2022-1119 No score
Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com
Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com
- Record
GO-2022-1119- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tailscale.com/cmdGo |
before 1.32.3 | 1.32.3 |
tailscaleAlpine:v3.24 |
before 1.32.3-r0 | 1.32.3-r0 |
tailscale.comGo |
before 1.32.3 | 1.32.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-41925 is a low vulnerability (CVSS 3.8) in Tailscale, published November 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in tailscale.com/cmd 1.32.3.
References
github.com/tailscale/tailscale/security/advisories/GHSA-qccm-wmcq-pwr6
emily.id.au/tailscale
tailscale.com/security-bulletins
nvd.nist.gov/vuln/detail/CVE-2022-41925
security.alpinelinux.org/vuln/CVE-2022-41925