Executive brief
A security vulnerability exists in the Tailscale management interface for OpenWrt routers. An authorized user with limited access can bypass security restrictions to run commands with the highest level of authority (root). This could allow an attacker to take full control of the router, intercept network traffic, or disrupt internet services.
Technical details
A command injection vulnerability exists in the `tailscale.do_login` RPC method of `luci-app-tailscale-community`. The root cause is improper neutralization of special elements within the `loginserver` and `loginserver_authkey` parameters. While individual values are passed through a quoting helper, the resulting string is embedded into an outer `/bin/sh -c` command using double quotes. This allows an authenticated attacker to use shell substitutions, such as `$()`, which are evaluated by the outer shell before the intended command execution. An attacker with LuCI/rpcd access can leverage this to achieve arbitrary code execution as the root user. As of the advisory date, no patched version has been identified in the source text.
Affected products
- OpenWrt luci-app-tailscale-community <= 0.11.1
Timeline
- 2026-06-11: advisory: Initial GHSA advisory published
- 2026-06-29: disclosed: NVD publication date