Tailscale investigated issues that could let a user already authorized for SSH access escalate privileges on a target, then shipped fixes in version 1.104.4. Exploitation requires existing device access and permission under the SSH policy; the company distinguishes this from an unauthenticated, self-propagating worm. Disabling forwarding in its initial advisory was a temporary mitigation. A follow-up also describes fixes affecting Serve and Funnel, making software updates and review of SSH access and check-mode policies the practical next steps.