# almeidapaulopt TSDProxy privilege escalation via auth token leakage

Source: https://junglewise.ai/threats/almeidapaulopt-tsdproxy-privilege-escalation-via-auth-token-leakage-b421497d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9 · Published 2026-07-10

TSDProxy, a tool used to manage Tailscale-based proxy services, contains a vulnerability where it accidentally shares its internal administrative password with the very services it is supposed to be protecting. If an attacker can control or compromise one of these backend services, they can steal this password and use it to take over the entire TSDProxy management system. This allows the attacker to shut down services, view private network configurations, or redirect traffic, potentially leading to a total loss of control over the proxy infrastructure.

Technologies: [github.com/almeidapaulopt/tsdproxy (Go)](https://junglewise.ai/threats/technologies/github-com-almeidapaulopt-tsdproxy). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9, published 10 July 2026.

**Which products and versions are affected?** Almeidapaulopt TSDProxy < 1.4.4-0.20260603142855-434819b4421e; github.com/almeidapaulopt/tsdproxy (Go) < 1.4.4-0.20260603142855-434819b4421e.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-03: First patched version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a hosted service.

**Am I affected?** Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in TSDProxy's request rewriting logic causes the internal `x-tsdproxy-auth-token` to be injected into upstream HTTP requests sent to backend services when `identityHeaders` is enabled. This token is the same secret used by the management HTTP server to authenticate administrative requests from localhost. An attacker with the ability to observe headers on a proxied backend service can capture this token and replay it to the TSDProxy management port (typically 127.0.0.1:8080) along with a spoofed `x-tsdproxy-id` header. This bypasses Tailscale authentication and grants the attacker full administrative access to the management API, including the ability to enumerate proxies, trigger webhooks (SSRF), and modify service states. The issue is fixed in version 1.4.4-0.20260603142855-434819b4421e.

## Affected products

- almeidapaulopt TSDProxy < 1.4.4-0.20260603142855-434819b4421e

## Timeline

- 2026-06-03: patched: First patched version released
- 2026-07-10: disclosed: Advisory published on GitHub

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [GO-2026-5982 - TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services…](https://junglewise.ai/threats/go-2026-5982-tsdproxy-x-forwarded-for-header-injection-allows-ip-6dd53b39)
- [GO-2026-5969 - TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in…](https://junglewise.ai/threats/go-2026-5969-tsdproxy-internal-proxy-auth-token-forwarded-to-backend-7460e81d)
- [almeidapaulopt TsDProxy IP spoofing via X-Forwarded-For injection](https://junglewise.ai/threats/almeidapaulopt-tsdproxy-ip-spoofing-via-x-forwarded-for-injection-1af4f42c)