Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Leveraging Tailscale Keys
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: This post introduces red team operators to Tailscale concepts and tradecraft that can be leveraged in the reader compromises Tailscale keys in their target environment.
Over the past year, we started coming across Tailscale authentication keys in Continuous Integration/Continuous Deployment (CI/CD) pipelines during Red Team assessments. Tailscale keys could play a critical role in achieving Red Team objectives, so it is advantageous to understand the implications of discovering Tailscale keys during an assessment. In this article, I provide a basic overview of Tailscale, cover key identification and usage, and offer guidance on Tailnet enumeration.
What is Tailscale?
Image source:https://tailscale.com/learn/understanding-mesh-vpns
Tailscale is a “mesh VPN” solution, which means that all machines (i.e., nodes) connected to the mesh network, called a Tailnet, can communicate with each other. All Tailscale nodes connect out from their location, with their assigned Tailnet IP address, to a Tailscale control server for intercommunication regardless of how many layers of NAT translation they sit behind. This configuration is a bit different from the traditional VPN situation where a VPN server is exposed to the internet so that clients can communicate through it with internal systems. What makes this interesting from a Red Team perspective is that each node can then provide Tailnet access to systems and networks on its local area network (LAN).
Types of Nodes
Figure: Tailscale Machine List in the Admin Console
There are several node types to be aware of, two of …