Tailscale Android: Missing caller authentication in IPN broadcast receiver
Summary
Tailscale Android build versionCode 297862600 exports a broadcast receiver without a permission or caller check. A locally installed app with no permissions can send a broadcast that changes the VPN exit-node setting, the allow-LAN-access setting, or the connect/disconnect state of the VPN. The exit node must already exist in the victim's netmap, and the connect action may require the system VPN consent on a fresh profile. The CVE record itself describes the issue only as insecure permissions, and the CVSS 9.1 score and CWE-732 are from NVD and could not be confirmed on NVD at the time of research.
Affected
- Tailscale Android app, versionCode 297862600 (version 1.102.3, F-Droid, added on Aug 27, 2026)
- Other versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed version was found for this CVE.
Workaround
- No vendor workaround known.
- Interim measure (not vendor guidance): limit which apps are installed on devices running Tailscale, especially on shared or company phones.
- If devices are managed by MDM, restrict local changes to the Tailscale app where the platform allows it.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV in the sources reviewed.
- A proof of concept exists according to the reporter's record (CISA SSVC: exploitation poc, not automatable).
- EPSS: 0.16 % (percentile 5).
Our recommendation
- Update the Tailscale Android app from a trusted store to the latest build and confirm the installed build is newer than versionCode 297862600.
- Check whether Tailscale is installed on shared or company phones and remove it where it is not needed.
- Review Tailscale admin-console logs and device settings for unexpected changes to exit nodes or VPN state.
- Monitor the Tailscale security bulletins for a vendor confirmation and fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F-Droid: Tailscale package f-droid.org
- Third-party advisory (F-Droid Android advisories) github.com
- Tailscale security bulletins tailscale.com
- NVD mirror (Vulners) vulners.com
- VulDB entry vuldb.com
- Strix CVE details www.strix.ai
- OffSeq Threat Radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:08.
Original description (NVD)
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.
NVD references (5)
- https://f-droid.org/packages/com.tailscale.ipn/
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md
- https://github.com/tailscale/tailscale
- https://tailscale.com/security-bulletins
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.