openSUSE 16: tailscale / tailscale-bash-completion / tailscale-fish-completion / etc (openSUSE-SU-2026:22203-1)

critical Nessus Plugin ID 374752

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22203-1 advisory.

Changes in tailscale:

Update to version 1.104.1:

- Go is updated to version 1.27
- WireGuard packet buffering uses less memory while waiting for peer handshakes
- WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic
- Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable
- WireGuard allocates a single packet buffer for batched I/O, improving throughput and reducing memory usage
- An issue that could prevent traffic over IPv6 link-local addresses from flowing through direct and Tailscale Peer Relay connections is resolved
- An issue preventing Linux desktop detection from working on Wayland environments is resolved

Update 1.102.5:

- The container no longer stops tailscaled when it falls behind on status updates and the connection is closed, which was common on large tailnets. It reconnects instead, and exits only if it cannot reconnect within one minute.

Update 1.102.4:

- All Platforms
- Resolved an issue that could cause a loss in connectivity when a netmap update occurs near the time of reauthentication.

Update 1.102.3:

- All Platforms

- Changed: Go is updated to version 1.26.6.
- Fixed: Tailscale refuses host-scoped IPv4 destinations at every point that acts on an unmapped 4via6 address. This fix addresses a security vulnerability described in TS-2026-011.
- Fixed: When MagicDNS is disabled, unqualified hostnames are correctly forwarded to the configured nameservers.
- Fixed: Resolved an issue where nodes with Tailnet Lock enabled on large tailnets would experience startup failures.

Update 1.102.2:

- Fixed: A regression causing incoming Tailscale Funnel connections to fail is resolved.

Update 1.102.1:

- All Platforms

- tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services.
- The tailscale get CLI command returns the current node's preferences.
- The tailscale whoami CLI command displays information about the current user and device.
- The tailscale service list CLI command displays Tailscale Services visible to the current node.
- Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets.
- Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals.
- Deprecated formats for 4via6 MagicDNS names are no longer available to use.
- TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate.
- Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode.
- Certificate issuance for multiple domains runs in parallel.
Provisioning multiple domains does not stall each certificate behind the previous one.
- Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go.
- A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node.
- A memory leak that occurred after a failed WireGuard handshake has been resolved.
- tailscale status --peers=false command shows the current device name in the output.
- Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.

- Linux

- Assembly crypto routines for 32-bit ARM are available, improving performance on these platforms.
- Userspace TUN optimizations improve throughput and performance.
- Resolved an issue impacting performance of UDP GSO on Linux v7.0.x through v7.1.4.

Update to version 1.98.10: (boo#1272825)

- Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004.
- Tailscale SSH preforms additional checks to disallow UIDs and numeric-only usernames. This fix covers additional scenarios described in TS-2026-006.

Update to version 1.98.9: (boo#1272825)

- Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004.
- Tailscale Serve Unix socket proxy targets are restricted to the root user. This fix addresses a security vulnerability described in TS-2026-005.
- Tailscale SSH does not allow the use of UIDs or numeric-only usernames. This fix addresses a security vulnerability described in TS-2026-006.
- Nodes advertising Tailscale Services filter and reject packets from service IPs on ports they do not advertise. This fix addresses a security vulnerability described in TS-2026-007.
- Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. This fix addresses a security vulnerability described in TS-2026-008.
- Tailscale SSH does not allow the use of usernames with leading dashes. This fix addresses a security vulnerability described in TS-2026-009.
- An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved.
- An issue that could cause a crash on 32-bit ARM platforms is resolved.

Update to version 1.98.8:

- An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved.
- An issue causing excessive handshake initiation retries in wireguard-go is resolved.
- An issue causing connection leaks in Tailscale SSH Session Recording is resolved.

Update to version 1.98.6:

- ssh/tailssh: reject dangerous LD_/DYLD_ env vars in acceptEnv filtering
- go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints
- wgengine/magicsock: suppress TSMP disco advert when bestAddr is peer
- control/controlknobs,wgengine/magicsock: disable TSMP disco advert if netmap caching is disabled

Update to version 1.98.4:

- An issue causing a deadlock when processing peer changes and disconnecting from the Tailscale control server is resolved

Update to version 1.98.3:

- An issue where netfilter rules could be applied inconsistently after a netfilter mode change failed has been resolved

Update to version 1.98.2:

- Ensure MagicDNS resolves tailnet hostnames after a network change

Update to version 1.98.1:

- Expired preferred peer addresses are cleared, reducing the time to elect an alternative
- IP forwarding for subnet routers and exit nodes is reported as a health check
- src_valid_mark sysctl is set in addition to connmark firewall rules to improve reverse path filtering and prevent dropped packets

Update to verison 1.96.4:

* An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
* An issue that could cause a segmentation violation during startup on MIPS devices is resolved

Update to version 1.96.3:

* DNS resolution issue caused by NRPT rule formatting is resolved

Update to version 1.96.2:

* tailscale dns query|status command supports --json flag to return JSON output
* tailscale wait [flags] command waits for Tailscale resources to become available for binding
* tailscale ip command supports --assert=<specific-ip-address> flag to assert that one or more of the node's IP addresses matches the specified IP address
* Tailscale Peer Relays advertise addresses discovered via Amazon EC2 Instance Metadata Service
* tailscaled_peer_relay_endpoints gauge user metrics are available for Tailscale Peer Relays
* The AuthKey system policy applies only when a user is not in a logged in state
* UPnP routes as expected during long lived port mapping sessions scenarios, including hard NAT
* Launch the systray application on startup using autostart file with the tailscale configure systray --enable-startup=freedesktop command
* Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware GOMAXPROCS defaults
* Firewall rules created on Linux platforms correctly mark their traffic, avoiding reverse path filtering dropping connections and producing health warnings and risk prompts

Update to version 1.94.2:

* Memory leak caused by high network map response rates is resolved

Update to version 1.94.1.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected tailscale, tailscale-bash-completion, tailscale-fish-completion and / or tailscale-zsh-completion packages.

Plugin Details

Severity: Critical

ID: 374752

File Name: openSUSE-2026-22203-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.29

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33747

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:tailscale-bash-completion, p-cpe:/a:novell:opensuse:tailscale-fish-completion, p-cpe:/a:novell:opensuse:tailscale-zsh-completion, p-cpe:/a:novell:opensuse:tailscale

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 3/26/2026

Reference Information

CVE: CVE-2026-33747

Detections

Analytics