CVE-2026-57999: Remote Root Command Injection in luci-app-tailscale-community

Technical summary

CVE-2026-57999 is a shell command injection vulnerability (CWE-78) in the tailscale.do_login RPC handler. The do_login method constructs a shell command that incorporates the loginserver and loginserver_authkey parameters without adequate quoting. Although these parameters are placed within double quotes, the outer shell still evaluates variable substitution syntax—allowing an authenticated caller to inject commands via shell expansion operators. This permits execution of arbitrary shell commands in the context of the root user.

Business impact

Exploitation of this vulnerability enables any authenticated user with access to the Tailscale configuration interface to gain root-level code execution on the affected device. In environments where the web UI is exposed on internal networks or accessible to multiple users, this creates a direct privilege escalation path. Attackers could modify system configuration, install persistence mechanisms, exfiltrate data, or pivot to other network segments using the compromised device as a foothold.

Affected systems

luci-app-tailscale-community is affected. The vulnerability requires an authenticated user session to exploit, so exposure is limited to systems where the web administration interface is accessible. No specific version numbers are documented in the advisory data; verify affected versions against the vendor's security notice.

Exploitability

The vulnerability is relatively straightforward to exploit: an authenticated attacker need only craft a login server parameter containing shell metacharacters (such as $(command) or `command`) and send it via the RPC interface. No additional user interaction is required, and no special network positioning is needed beyond authenticated access. The low complexity and lack of user interaction (UI:N) make this a practical risk in multi-user or shared-access environments.

Remediation

Apply the security patch from the luci-app-tailscale-community project. Verify the patched version against the vendor's advisory to ensure the fix properly quotes or sanitizes the loginserver and loginserver_authkey parameters. Until patched, restrict web UI access to trusted administrators and implement network segmentation to limit which users can reach the Tailscale configuration interface.

Patch guidance

Monitor the luci-app-tailscale-community repository and official channels for a patched release. When available, update to the corrected version and restart any dependent services. Test the patch in a non-production environment first to confirm compatibility with your configuration. If patches are delayed, mitigate by disabling the Tailscale web UI on untrusted networks or implementing reverse-proxy authentication controls.

Detection guidance

Monitor system logs and web server access logs for unusual RPC calls to tailscale.do_login with suspicious parameter values (e.g., containing $(), backticks, or semicolons). Endpoint detection and response (EDR) solutions should flag unexpected root-process spawning from the Tailscale web service. Network-based detection can identify anomalous RPC method calls with shell metacharacters in the loginserver field.

Why prioritize this

This vulnerability earns a HIGH CVSS score (8.8) due to high impact (full confidentiality, integrity, and availability compromise), low attack complexity, and the requirement for authentication that is present in typical multi-user or shared-network deployments. It should be prioritized for patching within 1–2 weeks, especially in environments where the Tailscale web UI is accessible to non-administrative accounts or exposed on semi-trusted internal networks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects complete system compromise (C:H/I:H/A:H) achieved through a low-complexity network-based attack (AV:N/AC:L). The PR:L (requires low privilege—i.e., authentication) slightly reduces the score from a 9.0, but the practical impact remains severe because authenticated access is common in corporate and shared-device environments.

Frequently asked questions