VulnerabilityPublished 7 Nov 2025

Description: A one-off auth key could be reused from multiple devices <h4>What

Source GCVE Database

Severity

Medium

Rated Medium by Threat Radar's AI analysis

Data as of 4 Nov 2026, 18:38 UTC

What to do

AI-suggested

No action is required by users. Tailscale deployed an official fix to the coordination server on 2025-11-07 that addresses this race condition by re-validating auth keys during the write transaction stage.

Description

A time-of-check/time-of-use (TOCTOU) race condition in Tailscale's coordination server allowed a one-off authentication key to be reused to register multiple nodes if registration attempts occurred simultaneously. This issue was fixed by adding re-validation of the auth key during the write transaction stage. No action is required by users as the fix was deployed on 2025-11-07.

Impact

One-off authentication keys intended for single use could be reused multiple times to register multiple nodes within a tailnet if registration requests occurred at approximately the same time. However, malicious nodes cannot exploit this issue to join a tailnet without a legitimate auth key. The issue affects tailnets using one-off auth keys through automation. Audit logs currently lack sufficient detail to detect this race condition, though improvements are planned.

Summary

The vulnerability involved a TOCTOU race condition in the Tailscale coordination server's node registration process. The server uses separate read and write database transactions to validate and then invalidate one-off auth keys. Previously, simultaneous registration requests could both pass the read validation before the auth key was invalidated in the write transaction, allowing multiple nodes to register using the same one-off auth key. The fix added re-validation of the auth key during the write transaction to prevent this race condition.

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 4 Nov 2026, 18:38 UTC

Technical details

Community reviews