# Tailscale Kubernetes API proxy: subnet hosts can impersonate tailnet identities Canonical: https://www.oktsec.com/radar/tailscale-kubernetes-api-proxy-ts-2026-018 Publisher: Oktsec Language: en Published: 2026-11-13T19:07:51Z Updated: 2026-11-13T19:07:51Z Record reviewed: 2026-11-13T19:07:51Z Latest evidence check: 2026-11-13T19:07:51Z Disclosed: 2026-11-12 A subnet host outside the tailnet could impersonate a tailnet node through a dedicated Kubernetes API proxy when routes and ACLs allow access. Tailscale 1.104.7 corrects the identity check; the operator’s in-process proxy is not affected. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The vendor provides a correction for a configuration dependent identity bypass that could expose Kubernetes administrator privileges. The reviewed sources do not confirm attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Tailscale - Products: Kubernetes API server proxy ## Technical overview TS-2026-018 concerns Tailscale’s dedicated Kubernetes API proxy. When a caller had no Tailscale identity, a fallback accepted its X-Forwarded-For header. A reachable subnet host could therefore make Kubernetes requests under another tailnet node’s identity, potentially with cluster administrator access. Applicability requires the dedicated kube-apiserver ProxyGroup or standalone k8s-proxy, acceptance of subnet routes, and an ACL grant allowing connections from hosts behind those routes. The operator’s in-process proxy is not affected. Enrolled clients authenticate with their actual source address and cannot trigger this fallback. The November 12 release, 1.104.7, removes that header fallback. Update the affected proxy deployment. If subnet hosts could previously connect, Tailscale recommends reviewing Kubernetes audit logs for unexpected identities. The vendor sources reviewed do not confirm exploitation in attacks. This record is separate from the Tailscale SSH and Serve issues covered in Tailworm. ## Recommended response Update affected proxy deployments to Tailscale 1.104.7 or later. If subnet hosts could reach the proxy, review Kubernetes audit logs for unexpected impersonated identities. Relevant to: Teams using Tailscale’s dedicated Kubernetes API server proxy or standalone k8s-proxy with subnet access. ## Affected systems and fixes ### Dedicated Kubernetes API server proxy or standalone k8s-proxy Affected: Deployments before 1.104.7 using a ProxyGroup with spec.type: kube-apiserver (or standalone k8s-proxy), accepting subnet routes with spec.tailscale.acceptRoutes: true and an ACL grant allowing hosts behind those routes to connect. The host exploiting this path has no Tailscale identity. Fixed release / action: Tailscale 1.104.7 or later in the affected proxy deployment. The operator’s in-process proxy is outside this issue; enrolled tailnet clients do not trigger the fallback. Confirm the running version against the vendor advisory, including any distribution backports. ## Response checklist 1. **Check proxy mode and subnet reachability** — Identify dedicated kube-apiserver ProxyGroups or standalone k8s-proxy deployments. Check acceptRoutes and ACL grants together; the operator’s in-process proxy is not affected. 2. **Update the affected proxy deployment** — Deploy Tailscale 1.104.7 or later and verify the running proxy version. Updating an unrelated tailnet client does not establish that this deployment is corrected. 3. **Review impersonated Kubernetes identities** — If hosts behind subnet routes could reach the proxy, follow Tailscale’s guidance to review Kubernetes audit logs for unexpected impersonated identities. Preserve relevant records for investigation. ## Relevance to AI environments Oktsec recommends including automation identities and Kubernetes service access in the review; the advisory does not establish AI involvement. ## Sources - [Tailscale TS-2026-018: scope, identity bypass and correction](https://tailscale.com/security-bulletins) — Tailscale; Vendor notice; checked 2026-11-13T19:05:55Z - [Tailscale Kubernetes Operator 1.104.7 release](https://tailscale.com/changelog) — Tailscale; Vendor notice; checked 2026-11-13T19:05:54Z ## Editorial record - 2026-11-13T19:07:51Z: Added TS-2026-018 with dedicated proxy prerequisites, the 1.104.7 correction and the vendor’s audit-log recommendation. This is distinct from the SSH Tailworm advisory; attacks are not established. ## Related incidents - [Tailworm: update Tailscale SSH and Serve to 1.104.4](https://www.oktsec.com/radar/tailscale-ssh-tailworm) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/tailscale-kubernetes-api-proxy-ts-2026-018) · [Build a response plan](https://www.oktsec.com/radar/tailscale-kubernetes-api-proxy-ts-2026-018#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=tailscale-kubernetes-api-proxy-ts-2026-018&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=tailscale-kubernetes-api-proxy-ts-2026-018&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.