Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9, published 10 July 2026.

Which products and versions are affected?

Almeidapaulopt TSDProxy < 1.4.4-0.20260603142855-434819b4421e; github.com/almeidapaulopt/tsdproxy (Go) < 1.4.4-0.20260603142855-434819b4421e.

Is there a fix for This vulnerability?

A patch was published on 2026-06-03: First patched version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

almeidapaulopt TSDProxy privilege escalation via auth token leakage

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-03: First patched version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected?

Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 9 · Published 2026-07-10

TSDProxy, a tool used to manage Tailscale-based proxy services, contains a vulnerability where it accidentally shares its internal administrative password with the very services it is supposed to be protecting. If an attacker can control or compromise one of these backend services, they can steal this password and use it to take over the entire TSDProxy management system. This allows the attacker to shut down services, view private network configurations, or redirect traffic, potentially leading to a total loss of control over the proxy infrastructure.

Technologies: github.com/almeidapaulopt/tsdproxy (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9, published 10 July 2026.
Which products and versions are affected?: Almeidapaulopt TSDProxy < 1.4.4-0.20260603142855-434819b4421e; github.com/almeidapaulopt/tsdproxy (Go) < 1.4.4-0.20260603142855-434819b4421e.
Is there a fix for This vulnerability?: A patch was published on 2026-06-03: First patched version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in TSDProxy's request rewriting logic causes the internal `x-tsdproxy-auth-token` to be injected into upstream HTTP requests sent to backend services when `identityHeaders` is enabled. This token is the same secret used by the management HTTP server to authenticate administrative requests from localhost. An attacker with the ability to observe headers on a proxied backend service can capture this token and replay it to the TSDProxy management port (typically 127.0.0.1:8080) along with a spoofed `x-tsdproxy-id` header. This bypasses Tailscale authentication and grants the attacker full administrative access to the management API, including the ability to enumerate proxies, trigger webhooks (SSRF), and modify service states. The issue is fixed in version 1.4.4-0.20260603142855-434819b4421e.

Affected products

almeidapaulopt TSDProxy < 1.4.4-0.20260603142855-434819b4421e

Timeline

2026-06-03: patched: First patched version released
2026-07-10: disclosed: Advisory published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.