Download Tailscale

Pin this version: winget install --id Tailscale.Tailscale --version 1.104.5 --exact

All Platforms - Fixed: Connectivity stalls affecting Tailscale SSH, Tailscale Serve, and tsnet on lossy networks are resolved. - Fixed: Tailscale SSH sessions no longer disconnect when a check mode approval expires. - Fixed: An issue that could cause Tailscale SSH restarts to hang or background tasks to terminate is resolved. Windows - Fixed: An issue in the Windows .exe installer that could lead to privilege escalation at install time has been resolved. Existing installations do not need to be reinstalled. macOS - Fixed: Connection reliability is improved when the network reports an unreachable destination. iOS - Fixed: Connection reliability is improved when the network reports an unreachable destination. tvOS - Fixed: Connection reliability is improved when the network reports an unreachable destination.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.104.5

Pin this version: winget install --id Tailscale.Tailscale --version 1.104.4 --exact

Note: v1.104.3 was an internal-only release. All Platforms - Fixed: Tailscale SSH performs Unix socket forwarding on behalf of the authenticated user rather than as root, preventing authorized peers from using local and remote forwarding to reach root-only Unix sockets such as the Docker socket or the tailscaled local API. This fix addresses a security vulnerability described in TS-2026-014. - Fixed: Tailscale SSH bounds the memory used for session handling and releases it when the peer disconnects, preventing denial of service through unbounded memory growth in tailscaled from continuous window-change messages and environment variable appends. This fix addresses a security vulnerability described in TS-2026-015. - Fixed: Tailscale Serve restricts TCP forwards to Unix socket backends and revalidates backend paths on each connection, preventing access to privileged Unix sockets such as the tailscaled local API socket. This fix addresses a security vulnerability described in TS-2026-016. - Fixed: Tailscale Serve derives per-request capabilities from the request context rather than from a context shared across all HTTP/2 streams, preventing Tailscale-App-Capabilities values from one mount from being sent with requests for another. This fix addresses a security vulnerability described in TS-2026-017.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.104.4

Pin this version: winget install --id Tailscale.Tailscale --version 1.104.2 --exact

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.104.2

Pin this version: winget install --id Tailscale.Tailscale --version 1.104.1 --exact

All Platforms - Changed: WireGuard packet buffering uses less memory while waiting for peer handshakes. - Changed: WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic. Linux - New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable. - Changed: WireGuard allocates a single packet buffer for batched I/O, improving throughput and reducing memory usage. - Fixed: An issue that could prevent traffic over IPv6 link-local addresses from flowing through direct and Tailscale Peer Relay connections is resolved. - Fixed: An issue preventing Linux desktop detection from working on Wayland environments is resolved. Windows - New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable. macOS Note: Tailscale v1.104 is built with Go 1.27, which does not run on macOS Monterey 12 (source). macOS users that want to run the latest version of Tailscale will require macOS Ventura 13 or later. macOS Monterey 12 is no longer supported by Apple and is no longer receiving security updates. - New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable. - New: Tailscale Services and Tailscale PAM Services are available in the app window. - New: Devices, Exit Nodes, and Services can be pinned to the top of their respective lists in the app window. Pins also appear in…

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.104.1

Pin this version: winget install --id Tailscale.Tailscale --version 1.102.4 --exact

All Platforms - Fixed: Resolved an issue that could cause a loss in connectivity when a netmap update occurs near the time of reauthentication. macOS - Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server. iOS - Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server. tvOS - Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server. - Fixed: Resolved an issue that prevented the VPN tunnel from automatically starting on a cold boot.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.102.4

Pin this version: winget install --id Tailscale.Tailscale --version 1.102.3 --exact

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.102.3

Pin this version: winget install --id Tailscale.Tailscale --version 1.102.2 --exact

All Platforms - Fixed: A regression causing incoming Tailscale Funnel connections to fail is resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.102.2

Pin this version: winget install --id Tailscale.Tailscale --version 1.102.1 --exact

All Platforms - New: tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services. - New: The tailscale get CLI command returns the current node's preferences. - New: The tailscale whoami CLI command displays information about the current user and device. - New: The tailscale service list CLI command displays Tailscale Services visible to the current node. - Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets. - Changed: Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals. - Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use. - Changed: TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate. - Fixed: Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode. - Fixed: Certificate issuance for multiple domains runs in parallel. Provisioning multiple domains does not stall each certificate behind the previous one. - Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go. - Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to…

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.102.1

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.10 --exact

All Platforms - Fixed: Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004. - Fixed: Tailscale SSH preforms additional checks to disallow UIDs and numeric-only usernames. This fix covers additional scenarios described in TS-2026-006.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.10

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.9 --exact

All Platforms - Fixed: Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004. - Fixed: Tailscale Serve Unix socket proxy targets are restricted to the root user. This fix addresses a security vulnerability described in TS-2026-005. - Fixed: Tailscale SSH does not allow the use of UIDs or numeric-only usernames. This fix addresses a security vulnerability described in TS-2026-006. - Fixed: Nodes advertising Tailscale Services filter and reject packets from service IPs on ports they do not advertise. This fix addresses a security vulnerability described in TS-2026-007. - Fixed: Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. This fix addresses a security vulnerability described in TS-2026-008. - Fixed: Tailscale SSH does not allow the use of usernames with leading dashes. This fix addresses a security vulnerability described in TS-2026-009. - Fixed: An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.9

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.8 --exact

Note: 1.98.6 and 1.98.7 were release candidates intended for testing only. All Platforms - Fixed: An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved. - Fixed: An issue causing excessive handshake initiation retries in wireguard-go is resolved. - Fixed: An issue causing connection leaks in Tailscale SSH Session Recording is resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.8

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.4 --exact

All Platforms - Fixed: An issue causing a deadlock when processing peer changes and disconnecting from the Tailscale control server is resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.4

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.2 --exact

All Platforms - Changed: Go is updated to 1.26.3. - Fixed: A regression from 1.98.0 is patched, ensuring MagicDNS resolves tailnet hostnames after a network change. Windows clients are unaffected.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.2

Pin this version: winget install --id Tailscale.Tailscale --version 1.98.1 --exact

Note: 1.98.0 was a release candidate intended for testing only. All Platforms - Fixed: Expired preferred peer addresses are cleared, reducing the time to elect an alternative. Linux - Changed: IP forwarding for subnet routers and exit nodes is reported as a health check, surfacing warnings when misconfigured. - Fixed: src_valid_mark sysctl is set in addition to connmark firewall rules to improve reverse path filtering and prevent dropped packets. macOS - New: Devices and exit nodes can be searched from the application's main menu on macOS Tahoe 26 or later. - New: The AppIntroShown system policy disables the Welcome to the Tailscale app modal window introduction that appears when you log in to Tailscale on a device for the first time. - Changed: The Hide Dock Icon checkbox in Settings is available when Tailscale is disconnected. - Fixed: The tailscale drive CLI command directs users to configure Taildrive through the client GUI instead of returning an error. - Fixed: Device list is more responsive, especially for larger tailnets. iOS - New: iOS devices can be used as exit nodes. - Fixed: Device list is more responsive, especially for larger tailnets.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.98.1

Pin this version: winget install --id Tailscale.Tailscale --version 1.96.3 --exact

Windows - Fixed: DNS resolution issue caused by NRPT rule formatting is resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.96.3

Pin this version: winget install --id Tailscale.Tailscale --version 1.96.2 --exact

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.96.2

Pin this version: winget install --id Tailscale.Tailscale --version 1.94.2 --exact

All Platforms - Fixed: Memory leak caused by high network map response rates is resolved.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.94.2

Pin this version: winget install --id Tailscale.Tailscale --version 1.94.1 --exact

Note: 1.94.0 was a release candidate intended for testing only. All Platforms - New: tailscaled_home_derp_region_id client metrics are available. - New: tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays. - New: Identity tokens are automatically generated for workload identities. - New: --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity. - New: tsnet nodes can host Tailscale Services. - Changed: The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format. - Changed: Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention. Linux - New: Custom DERP servers support Google Cloud Platform (GCP) Certificate Manager. - New: Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem. - Changed: Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems. - Fixed: Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale. - Fixed: MagicDNS always resolves when using resolve.conf without a DNS manager. macOS - New: AuthBrowser.macos system policy sets a preferred browser for opening automatic authentication URLs. - New: HideDockIcon system policy determines if the…

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.94.1

Pin this version: winget install --id Tailscale.Tailscale --version 1.92.5 --exact

Linux - Changed: State file encryption and hardware attestation keys are no longer enabled by default. - Fixed: Failure to load hardware attestation keys no longer prevents the client from starting. This could happen when the TPM device is reset or replaced. Windows - Changed: State file encryption and hardware attestation keys are no longer enabled by default. - Fixed: Failure to load hardware attestation keys no longer prevents the client from starting. This could happen when the TPM device is reset or replaced.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.92.5

Pin this version: winget install --id Tailscale.Tailscale --version 1.92.3 --exact

All platforms - Fixed: WireGuard configuration that occurs automatically in the client, no longer results in a panic. macOS - Fixed: Tailscale system extension no longer fails to install during an upgrade.

Release notes

Manifest: manifests/t/Tailscale/Tailscale/1.92.3