What Happened
On 25 October 2026, a researcher went public with a series of exploits targeted at the Tailscale VPN ecosystem. Chief amongst these was an attack against Tailscale’s built-in SSH server. When this optional service is enabled and when the weakness is correctly exploited, this could allow the user to obtain root access to the device in question. Other exploits allowed denial-of-service attacks against the Headscale server, and attacks aimed at other Tailscale features beyond the core VPN functionality.
Are You Vulnerable?
No. Nova does not enable the SSH server, nor anything else beyond the core functionality.
