Detections
Analytics

openSUSE 16 Security Update : tailscale (openSUSE-SU-2026:20192-1)

high Nessus Plugin ID 298725

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20192-1 advisory.

 Changes in tailscale:

 - Update to version 1.94.0:
 * IS SET and NOT SET have been added as device posture operators
 * India DERP Region City Name updated
 * Custom DERP servers support GCP Certificate Manager
 * Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem
 * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems
 * Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale
 * MagicDNS always resolves when using resolv.conf without a DNS manager
 * tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays
 * Identity tokens are automatically generated for workload identities
 * --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity
 * tsnet nodes can host Tailscale Services
 * The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format
 * Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention
 * Tailscale Services virtual IPs are now automatically accepted by clients across all platforms regardless of the status of the --accept-routes feature

 - Update to version 1.94.0:
 * derp/derpserver: add a unique sender cardinality estimate
 * syncs: add means of declare locking assumptions for debug mode
 * cmd/k8s-operator: add support for taiscale.com/http-redirect
 * cmd/k8s-operator fix populateTLSSecret on tests
 * feature/posture: log method and full URL for posture identity requests
 * k8s-operator: Fix typos in egress-pod-readiness.go
 * cmd/tailscale,ipn: add Unix socket support for serve
 * client/systray: change systray to start after graphical.target
 * cmd/k8s-operator: warn if users attempt to expose a headless Service
 * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
 * tsnet: ensure funnel listener cleans up after itself when closed
 * ipn/store/kubestore: don't load write replica certs in memory
 * tsnet: allow for automatic ID token generation

 - Update to version 1.92.5:
 * types/persist: omit Persist.AttestationKey based on IsZero
 * disable hardware attestation for kubernetes
 * allow opting out of ACME order replace extension
 - Update to version 1.92.4:
 * nothing of importance

 - Update to version 1.92.3:
 * WireGuard configuration that occurs automatically in the client, no longer results in a panic

 - Update to version 1.92.2:
 * cmd/derper: add GCP Certificate Manager support

 - Update to version 1.92.1:
 * fix LocalBackend deadlock when packet arrives during profile switch
 * wgengine: fix TSMP/ICMP callback leak
 - Update to version 1.92.0:
 * no changelog provided
 - Update to version 1.90.9:
 * tailscaled no longer deadlocks during event bursts
 * The client no longer hangs after wake up

 - Update to version 1.90.8:
 * tka: move RemoveAll() to CompactableChonk
 - Update to version 1.90.7:
 * wgengine/magicsock: validate endpoint.derpAddr
 * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
 * net/udprelay: replace VNI pool with selection algorithm
 * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
 * feature/relayserver: fix Shutdown() deadlock
 * net/netmon: do not abandon a subscriber when exiting early
 * tka: don't try to read AUMs which are partway through being written
 * tka: rename a mutex to mu instead of single-letter l
 * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable

 - Update to version 1.90.6:
 * Routes no longer stall and fail to apply when updated repeatedly in a short period of time
 * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This affected tailnets that use Tailscale SSH recording

 - Update to version 1.90.4:
 * deadlock issue no longer occurs in the client when checking for the network to be available
 * tailscaled no longer sporadically panics when a Trusted Platform Module (TPM) device is present

 - Update to version 1.90.3:
 * tailscaled shuts down as expected and without panic
 * tailscaled starts up as expected in a no router configuration environment

 - Update to version 1.90.2:
 * util/linuxfw: fix 32-bit arm regression with iptables
 * health: compare warnable codes to avoid errors on release branch
 * feature/tpm: check TPM family data for compatibility

 - Upate to version 1.90.1:
 * Clients can use configured DNS resolvers for all domains
 * Node keys will be renewed seamlessly
 * Unnecessary path discovery packets over DERP servers are suppressed
 * Node key sealing is GA (generally available) and enabled by default

 - update to version 1.88.3:
 * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
 * control/controlhttp: simplify, fix race dialing, remove priority concept
 - update to version 1.88.2:
 * k8s-operator: reset service status before append
 - require the minimum go version directly, in comparison to using the golang(API) symbol

 - update to version 1.88.1:
 * Tailscale CLI prompts users to confirm impactful actions
 * Tailscale SSH works as expected when using an IP address instead of a hostname and MagicDNS is disabled
 * fixed: Taildrive sharing when su not present
 * Taildrive files remain consistently accessible
 * new: Tailscale tray GUI
 * DERP IPs changed for Singapore and Tokyo
 - Fixing CVE-2025-58058, bsc#1248920

 - update to version 1.86.5:
 * cmd/k8s-proxy,k8s-operator: fix serve config for userspace mode
 - update to version 1.86.4:
 * nothing of relevance
 - update to version 1.86.3:
 * nothing of relevance

 - update to version 1.86.2:
 * A deadlock issue that may have occurred in the client
 * An occasional crash when establishing a new port mapping with a gateway or firewall

 - update to version 1.86.0:
 * tsStateEncrypted device posture attribute for checking whether the Tailscale client state is encrypted at rest
 * Cross-site request forgery (CSRF) issue that may have resulted in a log in error when accessing the web interface
 * Recommended exit node when the previously recommended exit node is offline
 * tailscale up --exit-node=auto:any and tailscale set --exit-node=auto:any CLI commands track the recommended exit node and automatically switches to it when available exit nodes or network conditions change
 * tailscaled CLI command flag --encrypt-state encrypts the node state file on the disk using trusted platform module (TPM)

 - update to 1.84.3:
 * ipn/ipnlocal: Update hostinfo to control on service config change

 - update to 1.84.2:
 * Re-enable setting accept-dns by using TS_EXTRA_ARGS. This issue resulted from stricter CLI arguments parsing introduced in Tailscale v1.84.0

 - update to 1.84.1:
 * net/dns: cache dns.Config for reuse when compileConfig fails

 - update to 1.84.0:
 * The --reason flag is added to the tailscale down command
 * ReconnectAfter policy setting, which configures the maximum period of time between a user disconnecting Tailscale and the client automatically reconnecting
 * Tailscale CLI commands throw an error if multiple of the same flag are detected
 * Network connectivity issues when creating a new profile or switching profiles while using an exit node
 * DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet

 - update to 1.82.5:
 * A panic issue related to CUBIC congestion control in userspace mode is resolved.

 - update to 1.82.0:
 * DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Let's Encrypt or WebPKI certificates.
 * Go is updated to version 1.24.1
 * NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available
 * Captive portal detection reliability is improved on some in-flight Wi-Fi networks
 * Port mapping success rate is improved
 * Helsinki is added as a DERP region.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected tailscale, tailscale-bash-completion, tailscale-fish-completion and / or tailscale-zsh-completion packages.

See Also

https://www.suse.com/security/cve/CVE-2025-22869

https://www.suse.com/security/cve/CVE-2025-58058

https://bugzilla.suse.com/1248920

Plugin Details

Severity: High

ID: 298725

File Name: openSUSE-2026-20192-1.nasl

Version: 1.1

Type: local

Agent: unix

Published: 2/12/2026

Updated: 2/12/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-22869

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:tailscale, p-cpe:/a:novell:opensuse:tailscale-bash-completion, p-cpe:/a:novell:opensuse:tailscale-fish-completion, p-cpe:/a:novell:opensuse:tailscale-zsh-completion

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2/10/2026

Vulnerability Publication Date: 2/26/2025

Reference Information

CVE: CVE-2025-22869, CVE-2025-58058