Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.
For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.
Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don’t need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.
Further links:
- Tailscale’s blogpost on findings and fixes, with security recommendations
- Tailscale’s security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
- Their prior investigation notes here
I don’t see it as there being much of a distinction from the two when you say one is public and the other isn’t, i don’t really see it that way. Wireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn’t be possible.
If you don’t need something specific that tailscale offers, then wireguard offers probably better security.
Tailscale uses wireguard, but using wireguard itself is removing all of the extra code and services (their connection facilitation layer?) that go with using tailscale.
Tailscale probably isn’t an inconsiquential amount of code added, so it can be a threat, even if it adds additional security layers (identity?). There’s more code to exploit.
Plus, wireguard is so well used directly by so many businesses, orgs and people who NEED it to be secure, and it has so many more eyes going over it that it I can’t see any way that it would be less secure.
Edit: have never used tailscale cuz i dont need it, so maybe im completely wrong about something, dont think i am tho im confident
There is something exposed to the Internet in both cases, yes, but it works very differently.
With WG it’s a client-server pattern; the server exposes a port, waits for authorized clients to connect, and when a client connects successfully the server routes their connections into the private LAN with everything that entails.
With TS the public part is a supplier of control configurations and client pairing service. The pairing service needs to be contacted by two authorized clients in order to negotiate a connection between them. Once that’s done, it’s the clients that route each other’s connections into their respective LANs, the pairing server is not involved anymore.
In other words the TS public surface is not WG, it’s their (proprietary) client verification and matching service. The WG connections between clients happen later, privately.
To me, separating client authentication from routing and transport looks like a better design, because it’s multi-layered. You get the normal WG authentication and another layer on top.
“Security” is a relative term. It’s better to think in terms of attack surface, exposure, whether attacks are targeted or not etc. Which are all ongoing factors.
Both TS and WG are popular and being used by lots of people but it’s also important for them to be actively maintained, independently audited, maintain transparency etc.