Tailscale SSH Socket Forwarding Abuse

Ankit Mehta@Secvyn

•updated 2 days ago•1•0•3

Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.