There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability identified in the Tailscale client allows a malicious website to access the peer API,
    which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API
    was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind
    DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the
    client, including accessing the node’s Tailscale environment variables. An attacker with access to the
    peer API on a node could use that access to read the node’s environment variables, including any
    credentials or secrets stored in environment variables. This may include Tailscale authentication keys,
    which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to
    learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version
    v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue. (CVE-2022-41925)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the
    Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows
    client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in
    cleartext with no Host header verification. This allowed an attacker-controlled website visited by the
    node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client,
    including changing the coordination server to an attacker-controlled coordination server. An attacker-
    controlled coordination server can send malicious URL responses to the client, including pushing
    executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All
    Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade
    to v1.32.3 or later to remediate the issue. (CVE-2022-41924)

  - A vulnerability identified in the Tailscale client allows a malicious website to access the peer API,
    which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API
    was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind
    DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the
    client, including accessing the node’s Tailscale environment variables. An attacker with access to the
    peer API on a node could use that access to read the node’s environment variables, including any
    credentials or secrets stored in environment variables. This may include Tailscale authentication keys,
    which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to
    learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version
    v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue. (CVE-2022-41925)

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、e0f26ac5-6a17-11ed-93e7-901b0e9408dc のアドバイザリに記載されている脆弱性の影響を受けます。

  - Tailscale チームの報告:  Tailscale クライアントで特定された脆弱性により、悪意のある Web サイトがピア API にアクセスし、これを利用して Tailscale 環境変数にアクセスする可能性があります。
    (CVE-2022-41925)

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e0f26ac5-6a17-11ed-93e7-901b0e9408dc advisory.

  - Tailscale team reports: A vulnerability identified in the Tailscale client allows a         malicious     website to access the peer API, which can then be used         to access Tailscale environment variables.
    (CVE-2022-41925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
426114	Alpine: multiple tailscale packages: security update to 1.32.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/8/16	critical
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
426114	Alpine: multiple tailscale packages: security update to 1.32.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/8/16	critical
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high
168042	FreeBSD: tailscale -- クライアントのセキュリティ脆弱性 (e0f26ac5-6a17-11ed-93e7-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2022/11/22	2023/10/3	high
168042	FreeBSD : tailscale -- Security vulnerability in the client (e0f26ac5-6a17-11ed-93e7-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2022/11/22	2023/10/3	high

检测

插件搜索

high

critical

high

critical

high

high

high

high