Tailscale — Security, Developer Tools product updates and releases, tracked on megachangelog.
Owner role users can now switch their tailnet's identity provider from the admin console for supported providers, which is now generally available.
The Tailscale Kubernetes Operator v1.104.1 introduces shared Let's Encrypt account keys for ingress ProxyGroups, custom UDP ports for PeerRelay, image pull secrets support in DNSConfig, improved rolling updates for egress ProxyGroups, and fixes for coordination server URL configuration and HA Service cleanup. New Helm chart customization options and security improvements are also included.
A new release of the Tailscale container image is available on Docker Hub and GitHub packages repository. This version includes library updates only.
Admins can now configure monitoring and alerts for device posture to help diagnose connectivity problems. New capabilities include badges on the Machines page, filtering by failing postures, custom error messages on clients, and push notifications for posture failures.
Tailscale v1.104.1 delivers significant performance improvements including reduced WireGuard memory usage, client-side netmap caching for offline resilience, and enhanced features like device pinning, improved Taildrop support, and platform-specific fixes across all supported devices.
Tailnet admins can now use policy to securely share resources between trusted tailnets in a declarative way, enabling controlled cross-tailnet access.
Fixed an issue where the Linux client would stop tailscaled when falling behind on status updates. The client now reconnects instead of exiting, and only terminates if it cannot reconnect within one minute.
The PAM web client at my.tailscale.com now runs as a single shared browser-based Tailscale device across all tabs. After authenticating once, you can connect to services in new tabs without reauthentication, eliminating repeated sign-in prompts.
Fixed an issue where the container would stop tailscaled when falling behind on status updates with a closed connection, especially problematic on large tailnets. The container now reconnects automatically and only exits if unable to reconnect within one minute.
The admin console Machines page now displays device posture status with assertions, machine values, pass/fail status, and counts of policy rules affecting each machine's posture requirements.
Fixed binary re-downloading on Linux by checking SHA matches, and added configurable log output grouping with a new log-mode parameter for control over grouped, ungrouped, or quiet logging.
Fixed an issue where the ProxyGroup reconciler was triggering on incorrect events, improving reconciliation accuracy.
Fixed connectivity loss during netmap updates near reauthentication, and resolved issues preventing exit nodes from appearing with custom coordination servers across macOS, iOS, and tvOS. Also fixed VPN tunnel auto-start on tvOS cold boot.
Tailscale announces a beta release of Privileged Access Management (PAM) enabling application-aware access control for SSH, databases, RDP, HTTPS, Kubernetes, and S3 resources. Features include session recording, policy-based access grants, credential injection, audit logs, and browser-based access without requiring a client download.
Aperture is now generally available, providing a comprehensive solution to secure and manage AI agents and LLM sessions with cost controls, request/response hooks, guardrails, and logging. Features include promotional model token credits, direct token purchasing, MCP support for agents and SSH access, chat projects for group collaboration, and baseline tool access management.
Fixed peer relay reachability across AWS availability zones and corrected Network Load Balancer health checks from TCP to HTTP for UDP-based peer relays, ensuring reliable connectivity and proper health reporting.
This release includes a security fix for host-scoped IPv4 destinations in 4via6 addresses (TS-2026-011), Go runtime update to 1.26.6, and multiple platform-specific fixes for MagicDNS, Tailnet Lock startup, Windows installer, and memory usage on iOS and tvOS.
The Tailscale container image now supports a TS_BOOT_TIMEOUT environment variable that allows you to configure how long the container waits for its initial connection to the coordination server, defaulting to 60 seconds.
The list tailnets endpoint now supports pagination with limit and cursor query parameters, defaulting to 100 results per page. Organizations with more than 100 tailnets can use the returned cursor value to retrieve additional results.
Tailscale Kubernetes Operator v1.102.2 adds support for in-cluster PeerRelays, Helm annotations, workload identity federation, 4via6 and IPv6 in egress resources, and includes multiple fixes for log output, MTU clamping, ProxyGroup reconciliation, DNS records, certificates, and rate-limit handling.
A new release of the Tailscale container image is now available. This version contains library updates and no functional changes.
Fixed an issue where the Tailscale tsrecorder would attempt to index empty recording placeholder files during startup, which has now been corrected.
A regression that caused incoming Tailscale Funnel connections to fail has been resolved.
Tailscale v1.102.1 introduces new CLI commands for getting preferences and user information, adds platform-specific improvements including protocol handlers on macOS and split-plane layout on iPad, and fixes multiple connectivity and performance issues across all platforms including a security vulnerability in Tailscale SSH (TS-2026-010).
New API endpoints allow you to programmatically create, list, and delete API-only tailnets in your organization. This enables automation of tailnet management at scale.
Fixed security vulnerabilities in Tailscale SSH, including Unix socket forwarding symlink permission handling and additional UID/username validation checks across all platforms.
The Tailscale admin console has moved to console.tailscale.com with automatic redirects from the old login.tailscale.com/admin/ URL. Authentication continues to use login.tailscale.com.
This release addresses six security vulnerabilities in Tailscale SSH, Serve, Funnel, and Services, plus fixes an issue where users could be unexpectedly logged out when changing device tags via CLI.
Microsoft Entra ID and Google Workspace group sync now includes members of nested groups, allowing for more comprehensive user management and access control.
Owners can now switch their tailnet's identity provider directly from the admin console for supported providers, without requiring manual intervention.
New OAuth Apps capability for Device Provisioning allows users to create and manage OAuth applications through the Tailscale API to automate device provisioning workflows.
Fixed connectivity disruptions after OS wake from sleep, excessive WireGuard handshake retries, and connection leaks in SSH Session Recording across all platforms.
A new ip:publicAddress device posture attribute is now available for use in postures and can be viewed on the Machines page of the admin console, with the feature available as beta in settings.
The Tailnet system policy now accepts comma-separated lists of tailnet IDs or organization IDs, allowing more flexible policy configuration.
Tailscale network flow logs and configuration audit logs can now be streamed to Azure Blob Storage, enabling centralized log storage and analysis in Azure environments.
Tailscale introduces Aperture chat interface with identity-aware MCP and API connectors, plus sandboxes for agents to perform chat-based tasks and coding. All features leverage tailnet access controls for unified identity management across chat, agents, and third-party integrations.
Devices on your tailnet can now receive group membership information from the Tailscale control plane, enabling better access control and visibility across your network.
macOS and iOS clients are now built using the Xcode 26.5 toolchain, ensuring compatibility with the latest Apple development tools.
Preset apps are now available for Oracle Cloud Infrastructure, providing pre-configured integrations for compute, networking, Object Storage, and Oracle Services Network across regions.
This release fixes token exchange failures when using workload identity and corrects MTU value clamping in Ingress and Egress ProxyGroup pods.
Resolved a deadlock that occurred when processing peer changes while disconnecting from the Tailscale control server.
Fixed a regression in tailscale_tailnet_key resource where the recreate_if_invalid parameter was not being checked before recreating the resource when a key is not found.
The Tailscale Kubernetes Operator v1.98.3 adds support for node affinity rules in DNSConfig, priority class names in the Helm chart, and fixes issues with long resource names, dual-stack IPv4/IPv6 addressing, and API server proxy auth key renewal.
Fixed an issue where recorder pods can now request a new auth key when required, improving reliability of the tsrecorder service.
A new release of the Tailscale container image is available with library updates only.
Resolved an issue where netfilter rules could be applied inconsistently after a netfilter mode change failed. Connmark and CGNAT rules are now applied only after the active netfilter mode is successfully updated, matching the behavior of other netfilter paths.
Aperture CLI (alpha) lets you launch and manage coding agents with built-in guardrails, policy enforcement, and observability. It supports Claude Code, Gemini CLI, OpenCode, OpenAI Codex, Copilot CLI, and Claude Cowork on devices inside and outside your tailnet.
Fixed an issue where the tailscale_tailnet_key resource was incorrectly clearing the key attribute during state refresh, and fixed a panic that occurred when keys were removed outside of Terraform.
Added new Domains page in the admin console to manage domain verification and domain aliases for your tailnet in one place.
This release adds support for managing Tailscale Services via the tailscale_service resource and data source. It introduces new authentication features including OIDC identity token support from runtime environments and the ability to read credentials from disk. The provider has migrated to the Terraform plugin framework and tightened validation for the audience argument in federated identity configuration.
This release updates Go to 1.26.3 and fixes a regression from v1.98.0 where MagicDNS failed to resolve tailnet hostnames after network changes on non-Windows platforms.
All plans can now purchase additional tagged resources beyond the included 50-device limit and view their current tagged resource usage against the limit.
This release fixes expired preferred peer address clearing to speed up alternative peer election, improves health checks for IP forwarding on Linux, adds device/exit node search on macOS, enables iOS devices as exit nodes, and resolves device list responsiveness issues across platforms.
Users can now view the device posture status of machines in their tailnet directly from the Machines page in the admin console, providing better visibility into device security and compliance.
Updated dependencies to remove Node 20 deprecation warning and ensure compatibility with current tooling.
API-only tailnets can now be accessed by any OAuth client with the all scope in the creating tailnet, expanding programmatic access capabilities.
Aperture (beta) is a new control plane for securing and managing LLM agents across providers and models. It enables custom guardrails with pre-call hooks to strip PII and restrict agent tools, configurable log retention with S3 export, audit logging for configuration changes, and customizable quotas across providers, models, users, and agents.
A new seat calculator tool is available to help users understand how many seats their account consumes before upgrading to a new plan.
Tailscale introduced new pricing that bills based on occupied user seats instead of monthly active users for new tailnets, increased free users on the Personal plan from three to six, made ephemeral node usage free within plan limits, and replaced the Starter plan with a new Standard plan. Existing legacy plans retain their previous billing model.
Services are now automatically advertised on startup with a new TS_EXPERIMENTAL_SERVICE_AUTO_ADVERTISEMENT environment variable to control this behavior. Fixed an issue where the container would attempt to create a secret even when TS_KUBE_SECRET was empty.
New features include authkey refresh for Ingress/Egress ProxyGroup pods, multiple tailnet access via new Tailnet custom resource, and namespace-level ProxyGroup creation controls via ProxyGroupPolicy. Removed TS_EXPERIMENTAL_KUBE_API_EVENTS variable and fixed TS_LOCAL_ADDR_PORT handling for IPv6 addresses.
The Recorder CRD now defaults to deploying a single replica StatefulSet with filesystem storage backend, simplifying default deployment configuration.
Resolved an out of memory condition in the network extension on iOS and tvOS that could occur when running large tailnets. This prevents crashes and improves stability on bigger networks.
Resolved stability issues on Linux and Synology including ENOSYS fallback handling, a segmentation fault on MIPS devices, and an Android disconnection deadlock.
Resolved a DNS resolution issue on Windows that was caused by improper NRPT rule formatting. This fix ensures DNS queries are properly resolved on Windows systems.
Tailscale v1.96.2 adds new CLI commands for DNS queries with JSON output, resource waiting, and IP assertion, introduces generally available windowed UI mode on macOS, and fixes multiple bugs across platforms including firewall rule marking on Linux, empty file transmission on macOS and iOS, and UPnP routing issues. Go has been updated to 1.26.
Workload identity federation is now generally available, allowing you to authenticate Tailscale API requests using federated OIDC workload identities from third-party providers.
Tailscale Peer Relays are now generally available, allowing users to set up self-hosted high-throughput relay servers for cases where direct connections aren't possible.
Tailscale now integrates with Huntress Managed EDR to collect device posture signals from devices in your tailnet, enabling better security visibility and policy enforcement.
Tailscale now integrates with Fleet Device Management to collect device posture signals from devices in your tailnet, enabling better visibility into device compliance and security status.
Aperture by Tailscale is a new tool to secure and monitor LLM sessions and AI agents, now available in alpha.
Fixed a crash when configuring an invalid Tailscale FQDN for an egress. The operator now logs errors gracefully and continues serving traffic instead of crashing.
Resolved a memory leak that occurred when network map responses were generated at high rates, improving overall stability and resource usage.
Container image v1.94.1 adds OAuth and workload identity federation support, enabling improved authentication for containerized deployments.
This release adds egress proxy support for Tailscale service VIPs and introduces Kubernetes API server proxy audit logging (beta). It also fixes stale TLS certificate serving in HA mode and resolves container resource configuration validation errors.
New release of Tailscale tsrecorder with library updates. Available on Docker Hub.
Tailscale network flow logs and configuration audit logs can now be streamed to Google Cloud Storage, enabling centralized log collection and archival.
Workload identity federation now supports provider-native identity token authentication for GitOps with GitHub Actions and GitLab CI. Token exchange error details are available in the Trust credentials page of the admin console.
Tailscale Services is now generally available, allowing you to decouple applications and services from the devices that host them for more flexible service management.
Added tsnet application support for Tailscale Services hosts, enabling new deployment capabilities on the Tailscale network.
Tailscale v1.94.1 introduces new client metrics for DERP regions and peer relays, automatic identity token generation for workload identities, and tsnet support for hosting Tailscale Services. It includes multiple fixes across platforms including DNS resolution on Linux, security vulnerability fixes on macOS, and improved relay throughput optimizations.
Added IS SET and NOT SET operators for device posture checks, allowing more flexible policy conditions based on whether posture attributes are set or unset.
The city name for Tailscale's India DERP server has been updated to Bengaluru to reflect the official name. Hosting provider and IP addresses remain unchanged.
State file encryption and hardware attestation keys are no longer enabled by default on Linux and Windows. Fixed a crash that occurred when the client failed to load hardware attestation keys due to TPM device reset or replacement.
Fixed an issue where hardware attestation keys were added to Kubernetes state Secrets, which prevented changing the Kubernetes node where Tailscale containers are deployed.
Certificate renewal now avoids ARI orders by default to prevent failures when ACME account keys are recreated. Hardware attestation keys are no longer stored in Kubernetes Secrets, enabling node migration for the operator.
A new release of Tailscale tsrecorder is available with library updates only. Download it from Docker Hub.
The Tailscale API now supports creating, reading, updating, and deleting federated identities. The Go client library and Terraform provider can also configure federated identities.
Fixed the Tailscale GitHub Action to use the correct architecture for storing and retrieving caches on macOS-based GitHub runners.
Fixed a Helm templating issue that occurred when an OAuth client secret was not set.
Released Tailscale container image v1.92.4 with a fix to ensure errors from background certificate renewal failures are properly logged.
A new release of Tailscale tsrecorder is available on Docker Hub with library updates only.
tsrecorder now supports authentication via a file-based auth key using the TS_AUTHKEY_FILE environment variable, providing more secure credential management for containerized deployments.
Fixed an issue where iptables could not be used on hosts that don't support nftables. The container image now works correctly on systems using iptables instead of nftables.
This release adds workload identity federation support for tailnet authentication and HTTP-to-HTTPS redirect annotations for Ingress resources. It also improves operator defaults, enables multi-replica Recorder deployments, fixes ArgoCD compatibility, and resolves issues with managed Ingress reconciliation and ProxyGroup-backed Ingress deletion.
Fixed a panic caused by automatic WireGuard configuration on all platforms, and resolved a system extension installation failure during macOS upgrades.
Tailscale v1.92.1 introduces support for the PROXY protocol in Funnel and Serve, static endpoints for Peer Relays, remote service destinations, workload identity federation, and improved network flow logs. The release also fixes Peer Relay handshake improvements and accessibility issues on macOS and iOS.
Fixes Taildrop functionality on macOS via the Share option and resolves a connectivity issue on Android when using custom control servers like Headscale.
Fixed tailscaled deadlocks during event bursts and client hangs after wake up with port mapping. Fixed DNS issues when switching between cellular and Wi-Fi connections on Android.
Fixed deadlock in tailscaled during event bursts and resolved client hang after wake-up when port mapping is enabled with slow interface initialization.
97 more changes from Tailscale. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.