megachangelog
Improvement1.102.1

Tailscale v1.102.1

Tailscale v1.102.1 introduces new CLI commands for getting preferences and user information, adds platform-specific improvements including protocol handlers on macOS and split-plane layout on iPad, and fixes multiple connectivity and performance issues across all platforms including a security vulnerability in Tailscale SSH (TS-2026-010).

All Platforms
  • New: tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services.
  • New: The tailscale get CLI command returns the current node's preferences.
  • New: The tailscale whoami CLI command displays information about the current user and device.
  • New: The tailscale service list CLI command displays Tailscale Services visible to the current node.
  • Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets.
  • Changed: Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals.
  • Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use.
  • Changed: TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate.
  • Fixed: Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode.
  • Fixed: Certificate issuance for multiple domains runs in parallel. Provisioning multiple domains does not stall each certificate behind the previous one.
  • Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go.
  • Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node.
  • Fixed: A memory leak that occurred after a failed WireGuard handshake has been resolved.
  • Fixed: tailscale status --peers=false command shows the current device name in the output.
  • Fixed: Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.
  • Fixed: Tailscale SSH passes environment variables to child processes via inherited file descriptors. This fix addresses a security vulnerability described in TS-2026-010.
Linux
  • New: Assembly crypto routines for 32-bit ARM are available, improving performance on these platforms.
  • Changed: Userspace TUN optimizations improve throughput and performance.
  • Fixed: Resolved an issue impacting performance of UDP GSO on Linux v7.0.x through v7.1.4.
macOS
  • New: The Tailscale protocol handler supports deep-linking to devices, exit nodes, and settings panels in the application window.
  • Changed: The device list in the menu bar and Windowed UI loads more efficiently.
  • Changed: The client onboarding process is redesigned to match the style of the windowed UI.
  • Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.
  • Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.
  • Fixed: Domain matching on-demand rules are evaluated in the correct order.
  • Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.
  • Fixed: tailscale configure kubeconfig checks permissions on the $KUBECONFIG file before refusing to write to it when it's in a non-standard directory, fixing false rejections during Kubernetes API server access setup.
iOS
  • New: A new split-plane layout is used on iPad in both portrait and landscape orientation and on sufficiently wide iPhones in landscape.
  • New: The status widget supports toggling the active exit node inline.
  • Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.
  • Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.
  • Fixed: Domain matching on-demand rules are evaluated in the correct order.
  • Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.
tvOS Android
  • Changed: A single CGNAT route is created when no other interface is using CGNAT.
  • Fixed: TCP connections do not reset when VPN routing changes due to a netmap update.
  • Fixed: Health warnings are promptly cleared as soon as the underlying issue is resolved.
Synology
  • Changed: RMv7 binaries with software floating point are produced for certain Synology NAS models, replacing older ARMv5 binaries.
clinetworkingperformancesecuritycross-platform

Source: original entry ↗