tailscale

No entries match these filters. Clear filters

1. changelog Oct 30, 2026 · issue 125

   tailscale: Configure route selection policy in the admin console with the new Route selection setting, replacing the Regional Routing toggle, to control how the tailnet⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When you have redundant subnet routers or exit nodes and want to control which path the tailnet prefers, configure Route selection in the admin console.
   📍In the admin console, go to Settings › Route selection and configure MagicRoute to choose between redundant subnet routers, app connectors, exit nodes, and Tailscale Service hosts.
   • View posture assertion details per machine — including each machine's value, pass/fail status, and a count of policy file rules that require a given posture — on the postures page of the admin console.
   • MacBooks with a notched display now show a notification window when the Tailscale icon is hidden behind the notch.
   • MacBooks with a notched display now show a notification window when the Tailscale icon is hidden behind the notch.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The split_dns field in the tailscale_dns_configuration Terraform resource is now defined as a set, not a list, which may require updates to existing configurations.
2. Device Provisioning with OAuth Apps (2026-10-27) Oct 27, 2026 · issue 123

   Tailscale OAuth Apps for Device Provisioning are now generally available via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. changelog Oct 20, 2026 · issue 114

   Tailscale Kubernetes operator gains PeerRelay custom UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ports, image pull secrets for all ServiceAccounts, and per-tailnet Let's Encrypt account keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Customize Helm-installed resource names to avoid collisions in shared clusters.
   values.yaml copy

   nameOverride: my-tailscale
   fullnameOverride: my-tailscale-operator

   • Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set by the operator on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping those Ingress resources reachable from inside the cluster after Tailscale Serve on Linux was scoped to the Tailscale interface only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds nameOverride and fullnameOverride Helm values to customize the names of resources the operator installs.
   • Adds custom UDP port support for PeerRelay resources so peers that cannot reach the relay at its load balancer address have an alternative path.
   • Supports sharing a single persistent Let's Encrypt account key per tailnet to keep certificate renewals exempt from Let's Encrypt rate limits.
   • Applies image pull secrets to every ServiceAccount the operator creates, not only the operator ServiceAccount.

   +3 more show less

   • Rolling updates of egress proxies now wait for each new pod to route traffic to all of its egress Services before proceeding to the next pod.
   • PeerRelay resources now use the coordination server URL configured for the operator.
   • PeerRelay replicas re-authenticate after losing their login, such as when the device is deleted or its auth key expires.
   • Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set by the operator on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping those Ingress resources reachable from inside the cluster after Tailscale Serve on Linux was scoped to the Tailscale interface only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds nameOverride and fullnameOverride Helm values to customize the names of resources the operator installs.
   • Supports sharing a single persistent Let's Encrypt account key per tailnet to keep certificate renewals exempt from Let's Encrypt rate limits.

   5 more in Everything

4. announced Oct 19, 2026 · issue 116

   Tailscale launches MagicRoute (beta) for Premium/Enterprise: location-based connector selection via Settings > General > Route Selection > Configure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable MagicRoute for your tailnet so every client automatically connects to its nearest healthy subnet router or app connector — replacing the old regional routing toggle.
   📍In the admin console, go to Settings › General › Route Selection › Configure and select MagicRoute.
   • Adds MagicRoute option under Settings > General > Route Selection > Configure in the admin console, giving each client automatic selection of the nearest healthy subnet router, app connector, or Tailscale Service host without relying on DERP regions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds three additional route-selection modes alongside MagicRoute in the admin console Configure section: Active-passive failover, Regional routing, and Regional routing with in-region failover.
   • MagicRoute supports tailnets with custom DERP servers, which were previously excluded from regional routing.
   • Clients at version 1.86.0 or later gain MagicRoute support for suggesting recommended exit nodes.
   • Adds MagicRoute option under Settings > General > Route Selection > Configure in the admin console, giving each client automatic selection of the nearest healthy subnet router, app connector, or Tailscale Service host without relying on DERP regions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • MagicRoute supports tailnets with custom DERP servers, which were previously excluded from regional routing.
   • Clients at version 1.86.0 or later gain MagicRoute support for suggesting recommended exit nodes.

   1 more in Everything

5. MagicRoute (2026-10-19) Oct 19, 2026 · issue 115

   Tailscale adds MagicRoute (beta) for redundant-path selection across subnet routers, app connectors, exit nodes, and Service hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable MagicRoute for your tailnet to let Tailscale automatically pick the best available subnet router or exit node when multiple redundant paths exist.
   📍In the admin console, go to Settings › Route selection and enable MagicRoute (beta).
   • Adds MagicRoute (beta) to automatically choose between redundant subnet routers, app connectors, exit nodes, and Tailscale Service hosts for resilient routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Replaces the Regional Routing toggle in the admin console with a new Route selection configuration surface for tailnet-wide route policy.
   • Adds MagicRoute (beta) to automatically choose between redundant subnet routers, app connectors, exit nodes, and Tailscale Service hosts for resilient routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Regional Routing toggle in the admin console is removed and replaced by the Route selection configuration; existing setups relying on that toggle must be reconfigured under the new Route selection surface.
6. docs update Oct 14, 2026 · issue 108

   Tailscale Aperture adds Claude Sonnet and Opus 5.5 model support with subscription passthrough for API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Configure Aperture to use your own Anthropic API key with Claude Sonnet 5.5 via subscription passthrough, rather than relying on the shared key.
   json copy

   "model": "claude-sonnet-5-5"

   • Adds claude-sonnet-5-5 and claude-opus-5-5 as supported models in Aperture provider configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports subscription passthrough providers so users can supply their own API key via provider config rather than using shared keys.

   2 details in Everything

7. Tailscale Kubernetes Operator v1.104.1 (2026-10-13) Oct 13, 2026 · issue 108

   Tailscale Kubernetes Operator v1.104.1 adds shared Let's Encrypt account keys, custom PeerRelay UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ports, and DNS image pull secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Override the default resource names when installing the operator into a cluster that has naming conventions or conflicts with the defaults.
   copy

   $ helm upgrade --install tailscale-operator tailscale/tailscale-operator \
     --set nameOverride=ts-operator \
     --set fullnameOverride=ts-operator-prod

   Allow nameserver pods managed by DNSConfig to pull images from a private registry by referencing an existing image pull secret.
   yaml copy

   apiVersion: tailscale.com/v1alpha1
   kind: DNSConfig
   metadata:
     name: ts-dns
   spec:
     nameserver:
       image:
         repo: my-registry.example.com/tailscale/k8s-nameserver
       imagePullSecrets:
         - name: my-registry-secret

   • Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set automatically on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping them reachable from inside the cluster after Tailscale Serve on Linux narrowed its listening interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds nameOverride and fullnameOverride values to the operator Helm chart to customize the names of installed resources.
   • Ingress ProxyGroups can now share a single persistent Let's Encrypt account key per tailnet to maintain rate-limit exemptions across certificate renewals.
   • PeerRelay resources support a custom UDP port and additional static endpoints for peers that cannot reach the relay at its load balancer address.
   • The DNSConfig custom resource supports image pull secrets for nameserver pods.

   +2 more show less

   • The operator Helm chart now applies image pull secrets to every ServiceAccount it creates, not only the operator ServiceAccount.
   • Rolling updates of egress ProxyGroups now wait for each new pod to route traffic to all of its egress Services before advancing to the next pod.
   • Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set automatically on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping them reachable from inside the cluster after Tailscale Serve on Linux narrowed its listening interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds nameOverride and fullnameOverride values to the operator Helm chart to customize the names of installed resources.
   • Ingress ProxyGroups can now share a single persistent Let's Encrypt account key per tailnet to maintain rate-limit exemptions across certificate renewals.

   4 more in Everything

8. Tailscale v1.104.1 (2026-10-07) Oct 7, 2026 · issue 097

   Tailscale v1.104.1 adds client-side netmap caching, device pinning, Taildrop URL/text support, and new macOS/iOS app capabilities across platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent the re-authentication pop-up from interrupting users on managed macOS fleets when a device key expires.
   text copy

   DisableReauthWindow

   • Adds DisableReauthWindow system policy on macOS to block the re-authentication window from appearing when a user's key has expired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds client-side netmap caching on Linux, Windows, and macOS to improve start-up speed and maintain connectivity when the Tailscale control plane is unreachable.
   • Adds Tailscale Services and Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Services to the macOS app window.
   • Adds the ability to pin Devices, Exit Nodes, and Services to the top of their respective lists in the macOS app window, with pins also appearing in a dedicated Pinned page.
   • Adds Tailscale iOS widgets to macOS Tahoe 26 and later.

   +6 more show less

   • Extends Taildrop on macOS, iOS, and Android to support URLs and text selections in addition to files.
   • Adds fast user switching in the iOS share sheet.
   • Adds the ability to disable remote client logging via the Bug Report menu on iOS and tvOS.
   • Adds device pinning to iOS, tvOS, and Android.
   • Drops support for macOS Monterey 12 (requires macOS Ventura 13 or later) as v1.104 is built with Go 1.27.
   • Drops support for iOS 15 (requires iOS 16 or later).
   • Adds DisableReauthWindow system policy on macOS to block the re-authentication window from appearing when a user's key has expired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds client-side netmap caching on Linux, Windows, and macOS to improve start-up speed and maintain connectivity when the Tailscale control plane is unreachable.
   • Adds Tailscale Services and Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Services to the macOS app window.
   • Adds the ability to pin Devices, Exit Nodes, and Services to the top of their respective lists in the macOS app window, with pins also appearing in a dedicated Pinned page.
   • Adds Tailscale iOS widgets to macOS Tahoe 26 and later.

   +5 more show less

   • Adds fast user switching in the iOS share sheet.
   • Adds the ability to disable remote client logging via the Bug Report menu on iOS and tvOS.
   • Adds device pinning to iOS, tvOS, and Android.
   • Drops support for macOS Monterey 12 (requires macOS Ventura 13 or later) as v1.104 is built with Go 1.27.
   • Drops support for iOS 15 (requires iOS 16 or later).

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !macOS Monterey 12 is no longer supported; Tailscale v1.104 requires macOS Ventura 13 or later (built with Go 1.27).
   • !iOS 15 is no longer supported; Tailscale v1.104 requires iOS 16 or later.
9. docs update Oct 6, 2026 · issue 096

   Aperture admin dashboard provides org-wide AI activity monitoring, request inspection, access management, and gateway configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Access the Aperture admin dashboard to monitor AI usage and manage access across your organization.
   📍Open http://<aperture-hostname>/admin/ in your browser — you must have the Aperture admin role. From here you can review quota balances, inspect retained captures, configure grants, and set spending limits.
   • Adds the Aperture admin dashboard at http://<aperture-hostname>/admin/ for monitoring organization-wide AI activity, investigating requests, managing access and spending, and configuring the gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-user spending limits and team budgets configurable through the admin dashboard.
   • Enables grant management for models, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and connectors by label from the admin dashboard.
   • Supports log filtering by request or response header from the admin dashboard.
   • Supports usage data export to S3 from the admin dashboard.

   +1 more show less

   • Supports configuring zero-retention mode from the admin dashboard.

   6 details in Everything

10. docs update Oct 6, 2026 · issue 096

    Tailscale Aperture gains gateway-generated client configs for Kilo Code, Grok Build, GitHub Copilot CLI, Pi, Hermes, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Route Grok Build requests through your Aperture gateway without supplying a real xAI API key — useful when per-model Aperture credentials already handle auth.
    copy

    $ XAI_API_KEY=not-needed grok

    • Adds gateway-generated configuration for Kilo Code: select Kilo Code on the Agents page, save the output as kilo.jsonc in your home config directory or project root, then reopen and pick an Aperture model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds gateway-generated configuration for Grok Build: select Grok on the Agents page, merge the generated TOML into ~/.grok/config.toml, and launch with grok; set XAI_API_KEY=not-needed if prompted for an xAI key at startup.
    • Adds gateway-generated configuration for GitHub Copilot CLI, Pi (~/.pi/agent/models.json), and Hermes (~/.hermes/config.yaml) from the Agents page.
    • Adds client setup guides for Claude Code, Claude Desktop, OpenAI Codex, OpenCode, and Roo Code/Cline (OpenAI-compatible API clients) to route inference through an Aperture gateway.
    • Adds the /agents endpoint on the Aperture gateway host as the central page for selecting clients and retrieving generated configurations.

    5 details in Everything

11. docs update Oct 6, 2026 · issue 096

    Tailscale Aperture introduces a browser agent at /chat, per-user and org-wide usage tracking with export and spending limits, and session/request capture inspection for admins.

    • Adds a browser agent available at /chat that connects tailnet machines to a task, runs commands with the user's access, and supports model chat, tool connections, and activity review — no separate client required.
    • Records user, model, and token counts per request; users can review their own usage and admins can review organization-wide usage, export data, and set spending limits.
    • Provides session and request capture inspection: users can inspect their own sessions, and admins can use the admin dashboard to inspect sessions across the organization and review full request and response data.
    • New integrationAperture selects a provider that supports both the requested model and the request's API format, routing clients based on model and permission checks.
    • Supports pass-through of client-supplied provider credentials, with clients able to send their own provider credentials when no fallback key is configured.

    5 details in Everything

    • New integration OpenAI-compatible provider support
12. docs update Oct 6, 2026 · issue 096

    Tailscale Aperture is a new AI gateway that uses Tailscale identity to authenticate LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. requests, with a CLI, Chat UI, and admin dashboard.

    • New integrationAdds the Aperture gateway to route LLM requests through Tailscale identity authentication, eliminating shared provider API keys.
    • Adds the Aperture CLI to discover, configure, and run coding agents through the Aperture gateway.
    • Adds an Aperture Chat web interface for talking to models, connecting tools, and reviewing personal usage.
    • Adds an Aperture admin dashboard to monitor organization-wide activity, manage access and spending, and configure the gateway.

    4 details in Everything

13. changelog Oct 5, 2026 · issue 095
    └──▷ HOW TO FIND IT
    Access multiple internal services in separate browser tabs without re-authenticating each time — open my.tailscale.com and sign in once, then navigate to each service in new tabs.
    📍In your browser, go to my.tailscale.com and authenticate. Then open internal services in new tabs — no additional sign-in prompts will appear.
14. changelog Oct 4, 2026 · issue 094

    Tailscale's PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. web client at my.tailscale.com now authenticates once across all browser tabs, eliminating repeated sign-in prompts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Access multiple internal services in one browser session without re-authenticating for each tab.
    📍In your browser, navigate to my.tailscale.com and authenticate once. Then open additional tabs to other services on your tailnet — no further sign-in prompts will appear.
    • Adds a single-session PAM web client at my.tailscale.com that runs as one shared browser-based Tailscale device across all tabs, so authenticating once covers every subsequent service connection in the same browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

15. docs update Sep 30, 2026 · issue 090

    Tailscale launches Aperture: an AI agent with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway proxy, identity-based access, and usage visibility for tailnet machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Route a coding assistant or CI job's LLM traffic through the Aperture gateway so requests are authenticated, logged, and billed centrally — without distributing provider API keys.
    📍# Set the base URL in your LLM client to the Aperture gateway endpoint. # The client names the model as usual, e.g. the model field set to the desired model name. # No other configuration changes are needed; Aperture injects the provider key and routes by model name.
    • Introduces Aperture Chat, a browser-based AI agent that connects tailnet machines to tasks and runs commands on them using the authenticated user's Tailscale identity — no separate login or API keys required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the Aperture gateway, a reverse proxy that sits between LLM clients and providers (OpenAI, Anthropic, Google), injects provider API keys, routes requests by model name, and records per-identity usage and cost.
    • Enables LLM clients (coding assistants, automated agents, CI jobs) to route traffic through the Aperture gateway by setting its base URL — no other client configuration required.
    • Provides visibility into LLM usage: the gateway records who made each request, attributes agent commands to the originating user, and applies policies.

    4 details in Everything

16. Tailscale PAM (2026-09-29) Sep 29, 2026 · issue 090

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. web client now shares a single browser device across tabs, eliminating repeated sign-in prompts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • The PAM web client at my.tailscale.com now runs as a single shared browser-based Tailscale device across all browser tabs, so authenticating once carries forward to every subsequent tab without re-prompting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

17. changelog Sep 26, 2026 · issue 086

    tailscale: Adds a device posture status detail view in the admin console showing each posture's required assertions, per-machine values, pass/fail state, and a count of policy file rules requiring that posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Control container log verbosity — use quiet in CI pipelines to suppress noise, or ungrouped when forwarding to structured log aggregators.
    copy

    $ docker run tailscale/tailscale --log-mode=quiet

    • Supports subscribing to tailnet events and routing notifications through an integration or app via webhooks.
    • Adds a log-mode parameter to the container to control whether logging output is grouped, ungrouped, or quiet.

    2 details in Everything

18. docs update Sep 26, 2026 · issue 086

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) adds identity-aware connectors for privileged access to SSH, databases, and Kubernetes over your tailnet⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces Tailscale PAM (beta), a Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. layer that combines VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. and PAM capabilities for identity-aware access to private tailnet resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PAM connectors — application-aware identity proxies that establish sessions between tailnet clients and services such as SSH, databases, and Kubernetes.
    • Supports Ansible-based installation and configuration of PAM connectors across one or more hosts.
    • Provides high-availability connector deployment to maintain connectivity during a single connector failure.
    • Includes protocol-aware capabilities in connectors: session recording, policy validation, and secrets management.

    5 details in Everything

19. changelog Sep 25, 2026 · issue 085

    tailscale: Supports subscribing to tailnet events and routing notifications through an integration or app.

    └──▷ USE IT
    Suppress verbose grouped log output in a container deployment to keep logs parseable by a downstream log aggregator.
    env copy

    log-mode=ungrouped

    • Skips re-downloading binaries on Linux when a file with a matching SHA already exists.

    1 more in Everything

20. changelog Sep 24, 2026 · issue 084

    Tailscale adds posture-assertion detail views, webhook event subscriptions, and per-device ping from the mobile app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review which posture assertions a specific machine is passing or failing before pushing a policy change.
    📍In the admin console, open Machines › select a device › Device posture — view each assertion, the machine's reported value, and the count of policy rules requiring that posture.
    • Enables pinging devices in your tailnet directly from the mobile app.
    • Shows a helpful banner when there are no other devices in the tailnet.

    2 details in Everything

21. docs update Sep 23, 2026 · issue 083

    Tailscale Aperture gains LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. client integration guides for Claude Code, Claude Desktop, Codex, OpenCode, and more⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Aperture chat UI so users can talk to LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. directly through their browser without a separate client.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports routing Claude Code requests through the Aperture proxy, authenticating via Tailscale identity.
    • Supports routing Claude Code GitHub Action requests through Aperture so CI runners authenticate with Tailscale identity instead of individual API keys.
    • Supports routing Claude Desktop model inference through the Aperture proxy.
    • Supports routing OpenAI Codex requests through the Aperture proxy.

    +3 more show less

    • Supports routing OpenCode requests through the Aperture proxy.
    • Supports routing OpenAI-compatible tools — including Gemini CLI, Roo Code, and Cline — through Aperture.
    • Adds a Tailscale skill (alpha) enabling coding agents such as Claude Code, Cursor, or OpenAI Codex to work with Tailscale configuration, the CLI, and the API.

    8 details in Everything

22. docs update Sep 23, 2026 · issue 083

    Aperture gains two methods for connecting non-tailnet devices: an Aperture CLI bridge and the standalone ts-unplug proxy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run ts-unplug on a CI runner to expose Aperture on a fixed local port without installing Tailscale on the host.
    copy

    $ ./build/ts-unplug -dir ./state -port <aperture-hostname>.<tailnet-name>.ts.net

    Verify the ts-unplug proxy is forwarding requests correctly before wiring it into a script or CI job.
    copy

    $ curl -s http://localhost:8080/v1/messages \
      -H "Content-Type: application/json" \
      -d '{"model": "claude-haiku-4-5-20251001", "max_tokens": 25, "messages": [{"role": "user", "content": "respond with: hello"}]}'

    Create and activate an Aperture CLI bridge for an interactive coding session on a device outside the tailnet.
    📍1. Run aperture, then press s to open Settings. 2. Select Bridges, press a, and enter a name (e.g. ci-runner). 3. Return to Settings, select Aperture Endpoints, press a, choose Bridge, select the bridge, and enter your Aperture URL (e.g. http://<aperture-hostname>.<tailnet-name>.ts.net). 4. Select the new endpoint to activate it, then open the printed authentication URL in a browser. 5. If required, approve the device in the Machines page of the admin console.
    • Adds ts-unplug (from the ts-plug repository), a standalone proxy built with make ts-unplug that accepts -dir and -port flags and forwards local traffic to an Aperture gateway for devices that cannot join the tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Aperture CLI bridge feature — activated via the Bridges settings menu — that embeds a Tailscale node inside the CLI and auto-configures launched coding agents to use a local proxy endpoint.
    • Supports auth key authentication for both the CLI bridge and ts-unplug, enabling non-interactive approval for ephemeral environments such as CI/CD runners.
    • Enables cross-tailnet and contractor/personal-device access to Aperture without requiring Tailscale to be installed on the connecting device.
    • Adds ts-unplug (from the ts-plug repository), a standalone proxy built with make ts-unplug that accepts -dir and -port flags and forwards local traffic to an Aperture gateway for devices that cannot join the tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Aperture CLI bridge feature — activated via the Bridges settings menu — that embeds a Tailscale node inside the CLI and auto-configures launched coding agents to use a local proxy endpoint.
    • Enables cross-tailnet and contractor/personal-device access to Aperture without requiring Tailscale to be installed on the connecting device.

    1 more in Everything

23. docs update Sep 23, 2026 · issue 083

    Tailscale launches Aperture, an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway that routes AI traffic over your tailnet to providers like OpenAI, Anthropic, and Gemini⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Register Anthropic as an LLM provider with two Claude models via the Aperture JSON configuration editor.
    json copy

    {
      "providers": {
        "anthropic": {
          "baseurl": "https://api.anthropic.com",
          "apikey": "<anthropic-api-key>",
          "models": ["claude-sonnet-4-6", "claude-opus-4-8"],
          "authorization": "x-api-key",
          "compatibility": {
            "anthropic_messages": true
          }
        }
      }
    }

    Send a test prompt to Aperture using the Anthropic API format to verify the gateway is routing requests correctly.
    copy

    $ curl -s http://<aperture-hostname>/v1/messages \
      -H 'Content-Type: application/json' \
      -d '{"model": "claude-haiku-4-5-20251001", "max_tokens": 25, "messages": [{"role": "user", "content": "respond with: hello"}]}'

    Send a test prompt to Aperture using the OpenAI Chat API format — useful when routing existing OpenAI-compatible clients through the tailnet gateway.
    copy

    $ curl -s http://<aperture-hostname>/v1/chat/completions \
      -H 'Content-Type: application/json' \
      -d '{"model": "gpt-5.5", "messages": [{"role": "user", "content": "respond with: hello"}]}'

    • Adds providers.<name>.baseurl, providers.<name>.apikey, providers.<name>.models, providers.<name>.authorization, and providers.<name>.compatibility configuration keys in the Aperture JSON Configuration editor to register LLM providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes POST /v1/messages (Anthropic API format), POST /v1/chat/completions (OpenAI Chat API format), and POST /v1/responses (OpenAI Responses API format) endpoints on the Aperture gateway at http://<aperture-hostname>.
    • Supports OpenAI, Anthropic, Google Gemini, OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code., Amazon Bedrock, the Gemini Enterprise Agent Platform, and any OpenAI-compatible provider as routable LLM backends.
    • Introduces Aperture, a new LLM gateway that proxies AI API traffic over a tailnet, accessible at http://<aperture-hostname> from any device in the tailnet.
    • Supports passthrough mode for consumer/business subscription plans (Claude Pro, ChatGPT Plus, Gemini Advanced) by preserving client-supplied Authorization or x-api-key headers.

    +3 more show less

    • Enables proxying MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and HTTP APIs through Aperture to give AI agents authenticated access to external tools.
    • Supports spending limits, per-user model access grants, and a browser-based chat UI as built-in management capabilities.
    • Supports ts-unplug and an Aperture CLI bridge to route traffic from devices outside the tailnet via http://localhost:<port-number>.

    8 details in Everything

24. docs update Sep 23, 2026 · issue 083

    Aperture by Tailscale is a new centralized AI gateway that secures, monitors, and routes LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. requests across your organization via your tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Route any OpenAI-compatible provider (e.g. Groq) through Aperture by pointing to its base URL — clients then use model names as normal, with no provider credentials on their devices.
    yaml copy

    baseurl: "https://api.groq.com/openai"
    apikey: "<your-groq-key>"
    compatibility: openai_chat

    Use a Claude Max or ChatGPT Plus subscription plan with Aperture by enabling passthrough mode, which forwards the client-supplied Authorization header instead of injecting a centrally managed key.
    yaml copy

    auth_mode: "passthrough"

    • Adds openai_chat compatibility flag and baseurl/apikey config fields so any provider exposing a /v1/chat/completions endpoint (Groq, Together AI, Fireworks, Mistral, DeepSeek, Perplexity, and others) works with Aperture without code changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds custom:createdByAperture and custom:createdByAI node attributes that Tailscale binds to devices provisioned through the built-in tailnet connector via approved single-use auth keys.
    • New Aperture gateway centrally manages LLM provider API keys in server configuration, injecting them per-request so no provider credentials ever reach developer devices or CI/CD systems.
    • New Aperture CLI bridge and ts-unplug allow clients outside the tailnet (including CI/CD environments such as GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.) to connect to Aperture with full Tailscale-based identity.
    • New built-in chat UI lets users interact with configured LLM models directly from a browser without a separate client.

    +7 more show less

    • New Aperture dashboard (Usage Overview page) provides organization-wide adoption analytics: active users over time, usage histograms, and per-user/per-model/per-time-period cost tracking with configurable budgets and per-user spending limits.
    • New Logs page in the Aperture dashboard groups related requests into sessions for admin-level conversation and coding-task tracing with full request/response data.
    • New retention policy configuration controls how long Aperture keeps captured request/response bodies, with a zero data retention mode that prevents prompt or response content from ever being written to disk.
    • New connectors feature proxies connections to external MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and HTTP APIs, injecting authentication automatically so AI agents discover available services through the MCP tool list without managing individual credentials.
    • New guardrails capability inspects, modifies, or blocks LLM requests at the gateway before they leave the network, enabling PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. scrubbing, tool-declaration restrictions, and content policy enforcement.
    • Supports routing LLM requests to self-hosted LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. inside a tailnet without exposing endpoints to the public internet.
    • Adds log and event export to external SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems for durable storage and review of captured LLM traffic.

    12 details in Everything

25. docs update Sep 23, 2026 · issue 083

    tailscale: Introduces Aperture, a centralized AI gateway that routes LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. requests to upstream providers (OpenAI, Anthropic, Google) using Tailscale identity for authentication — no API key distribution required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server proxying to aggregate tools and resources from remote MCP servers with identity-based access control.
    • Provides an Aperture CLI for discovering, configuring, and running coding agents through the Aperture proxy.
    • Supports spending controls including per-user quotas, budgets, and token purchasing to manage LLM costs across an organization.
    • Supports exporting usage data and integrating with external authorization engines and log aggregators for observability and governance.
    • Supports configurable data retention and privacy controls governing where request content is stored and exported.

    5 details in Everything

26. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. adds external secret references (from:) for env vars, files, AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution., AWS Secrets Manager, and Keeper Secrets Manager⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Configure a database PAM service to pull its username from an environment variable and its password from AWS SSM Parameter Store — no plaintext credentials in the service config.
    text copy

    Username: from:env:RDS_USERNAME
    Password: from:aws:ssm:/production/database/password

    Extract individual fields from a JSON secret stored in AWS Secrets Manager so a single secret object can serve both username and password fields.
    text copy

    Username: from:aws:secretsmanager:production-database,jq_exp=.username
    Password: from:aws:secretsmanager:production-database,jq_exp=.password

    Configure an SSH PAM service to retrieve its credentials from a local file and AWS Secrets Manager, keeping secrets out of Tailscale PAM configuration entirely.
    text copy

    Username: from:file:/etc/ssh_username
    Password: from:aws:secretsmanager:/staging/sshpassword

    • Supports from:env:<VARIABLE> secret references in Tailscale PAM service configuration fields to pull credentials from environment variables at connector runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports from:file:<PATH> secret references to read credentials from files on the connector host.
    • Supports from:aws:ssm:<PATH> secret references to retrieve credentials from AWS Systems Manager Parameter Store, requiring connector IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. read permissions.
    • Supports from:aws:secretsmanager:<PATH> secret references to retrieve credentials from AWS Secrets Manager, requiring connector IAM read permissions.
    • Supports from:keeper:<RECORD>:<FIELD> secret references to pull credentials from Keeper Secrets Manager via the ksm CLI, which must be installed and in PATH on the connector host.

    +2 more show less

    • Adds jq_exp=<expression> option to any from: secret reference to extract a single field from a JSON secret using dot notation (e.g., from:aws:secretsmanager:production-database,jq_exp=.password).
    • Allows SSH, database, and AWS PAM service types to use from: references in upstream username, password, hostname, AWS access key ID, and AWS secret access key configuration fields instead of storing plaintext values.

    7 details in Everything

27. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) adds grant-based access control for databases, SSH, Kubernetes, and Amazon S3 with per-protocol permissions in the tailnet policy file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Grant a platform team read-only access to all databases on a production database PAM service, while additionally allowing DELETE on the books database.
    json copy

    {
      "grants": [
        {
          "src": ["group:platform"],
          "dst": ["svc:production-database"],
          "ip": ["*"],
          "app": {
            "tailscale.com/cap/pam": [
              {
                "version": "v1",
                "permissions": {
                  "database": {
                    "allowed_databases": [
                      {"database": "*", "allowed_query_types": ["ReadOnly"]},
                      {"database": "books", "allowed_query_types": ["ReadOnly", "DELETE"]}
                    ]
                  }
                }
              }
            ]
          }
        }
      ]
    }

    Allow a support group to run two specific SSH commands and use SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. against a PAM SSH service, without granting an interactive shell.
    json copy

    {
      "grants": [
        {
          "src": ["group:support"],
          "dst": ["svc:prod-ssh"],
          "ip": ["*"],
          "app": {
            "tailscale.com/cap/pam": [
              {
                "version": "v1",
                "permissions": {
                  "ssh": {
                    "exec": {
                      "commands": [
                        "^systemctl status nginx$",
                        "^journalctl -u nginx --since today$"
                      ]
                    },
                    "sftp": {},
                    "allowed_usernames": ["support"]
                  }
                }
              }
            ]
          }
        }
      ]
    }

    Restrict a developer group to list-only Kubernetes access across all namespaces via a PAM Kubernetes service.
    json copy

    {
      "grants": [
        {
          "src": ["group:developers"],
          "dst": ["svc:k8s-cluster"],
          "ip": ["*"],
          "app": {
            "tailscale.com/cap/pam": [
              {
                "version": "v1",
                "permissions": {
                  "kubernetes": {
                    "rules": [
                      {
                        "namespaces": ["*"],
                        "verbs": ["list"],
                        "resources": ["*"]
                      }
                    ]
                  }
                }
              }
            ]
          }
        }
      ]
    }

    • Adds tailscale.com/cap/pam application capability to tailnet policy file grants, enabling PAM access control with src, dst (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ svc:production-database), and app fields for deny-by-default service access.
    • Adds database permission block under tailscale.com/cap/pam with allowed_databases, database, and allowed_query_types fields supporting values like ReadOnly, ReadWrite, SELECT, INSERT, UPDATE, DELETE — enforced for MySQL and PostgreSQL.
    • Adds ssh permission block with exec.commands (regex allowlist), allowed_usernames, sftp, and tcp_forwarding.allowed_connections fields to control SSH exec, SFTP, interactive shell, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. forwarding independently.
    • Adds kubernetes permission block with rules containing verbs, namespaces, resources, resource names, and api groups fields to allowlist Kubernetes API operations per connector.
    • Adds aws_s3 permission block with rules containing buckets, paths, and actions fields (supporting list, read, write, delete and * wildcards) to restrict S3 access per bucket and path.

    +2 more show less

    • Adds PAM service destinations (e.g. svc:production-database) as a new selector type usable in dst alongside users, devices, groups, and tags in the tailnet policy file.
    • Adds Application-level options expansion in the visual policy editor's Access controls page, automatically selecting tailscale.com/cap/pam when a PAM service is chosen as a destination and generating the grant JSON preview.

    7 details in Everything

28. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) adds service accounts for programmatic API access and clientless HTTP service access via Border0 API tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Authenticate to the Tailscale PAM API to list connectors — useful for scripts or Terraform pipelines that manage PAM resources programmatically.
    copy

    $ curl https://api.border0.com/api/v1/connectors \
      -H "accept: application/json" \
      -H "Authorization: <your-token>"

    Access a PAM-protected HTTP service from a workload without the Tailscale client, using a tag-backed client service account token.
    copy

    $ export BORDER0_TOKEN=<your-token>
    curl https://nginx1-demo.border0.io \
      -H "Border0-Token: $BORDER0_TOKEN"

    • Adds Border0-Token request header support for clientless access to Tailscale PAM HTTP services without installing the Tailscale client.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes the Tailscale PAM API at https://api.border0.com for programmatic management of services, connectors, policies, and session data using service account tokens.
    • Introduces Tailscale PAM service accounts with four roles — Administrator, Member, Service Manager, and Read Only — enabling least-privilege automation access to PAM resources.
    • Automatically represents each Tailscale tag as a client-role PAM service account, allowing tag-backed identities to generate tokens for clientless HTTP access.
    • Supports Terraform-based infrastructure-as-code management of Tailscale PAM via the Border0 Terraform provider, authenticated with a PAM service account token.

    5 details in Everything

29. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. now supports storing session recordings in your own Amazon S3 bucket via cross-account IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Create the IAM policy granting Tailscale PAM read/write access to your S3 bucket, then attach it to a cross-account role Tailscale can assume — no long-lived AWS credentials required.
    json copy

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:GetBucketLocation"
          ],
          "Resource": [
            "arn:aws:s3:::my-pam-recordings",
            "arn:aws:s3:::my-pam-recordings/*"
          ],
          "Effect": "Allow",
          "Sid": "AllowAccessS3Bucket"
        }
      ]
    }

    Lock down the IAM role trust policy so only Tailscale PAM's account can assume it, using an external ID to prevent confused-deputy attacks.
    json copy

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": ["arn:aws:iam::235487987553:root"]
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "my-unique-external-id"
            }
          }
        }
      ]
    }

    Point Tailscale PAM at your S3 bucket after creating the AWS resources, so new session recordings are written to your own account instead of Tailscale-managed storage.
    📍1. Open the PAM page of the Tailscale admin console. 2. In the Recording storage section, select Configure storage. 3. Enter the name of your S3 bucket (e.g. my-pam-recordings). 4. Enter the ARN of the IAM role (e.g. arn:aws:iam::123456789012:role/pam-recordings). 5. Enter the External ID you set in the IAM role trust policy. 6. Optionally enter the AWS region containing the bucket. 7. Select Save.
    • Adds IAM policy with s3:PutObject, s3:GetObject, s3:ListBucket, and s3:GetBucketLocation on arn:aws:s3:::${BUCKET_NAME} and arn:aws:s3:::${BUCKET_NAME}/* to grant Tailscale PAM access to a customer-owned S3 bucket.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds IAM role trust policy allowing Tailscale PAM's AWS account (arn:aws:iam::235487987553:root) to assume the role via sts:AssumeRole, with optional sts:ExternalId condition for extra security.
    • Adds Recording storage section in the PAM page of the Tailscale admin console to configure a custom S3 bucket, IAM role ARN, optional external ID, and optional AWS region.
    • Supports custom S3 recording storage for Tailscale PAM (Premium plan), letting teams control storage location, retention, encryption, and access policy for session recordings.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Switching recording storage location does not migrate existing recordings — recordings previously stored by Tailscale will no longer be available for replay in the admin console after switching to a custom S3 bucket.
30. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. resources can now be managed as Infrastructure as Code via the Border0 Terraform provider⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Provision a PAM connector and an HTTP service together in one Terraform config, authenticated via an env var to avoid storing secrets in HCL.
    copy

    $ export BORDER0_TOKEN="<service-account-token>"
    terraform init
    terraform apply

    Define a PAM connector and associate an HTTP service with it so an internal admin app is reachable through Tailscale PAM.
    main.tf copy

    terraform {
      required_providers {
        border0 = {
          source = "borderzero/border0"
        }
      }
    }
    
    provider "border0" {}
    
    resource "border0_connector" "production" {
      name        = "production"
      description = "Tailscale PAM connector for production services"
    }
    
    resource "border0_socket" "internal_admin" {
      name          = "internal-admin"
      description   = "Internal admin application"
      socket_type   = "http"
      connector_ids = [border0_connector.production.id]
    
      http_configuration {
        upstream_url = "https://admin.internal.example.com"
      }
    }

    • Adds Terraform IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. support for Tailscale PAM using the borderzero/border0 provider, with the BORDER0_TOKEN environment variable for authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds border0_connector Terraform resource to create and manage Tailscale PAM connectors.
    • Adds border0_socket Terraform resource to create and manage Tailscale PAM services, with socket_type, connector_ids, and http_configuration.upstream_url fields.

    3 details in Everything

31. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. now supports custom DNS domains for HTTP services, with wildcard CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. routing and automatic TLS provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Expose a PAM HTTP service at a human-readable hostname under your own domain instead of the default PAM hostname.
    📍In the Tailscale admin console, go to PAM › Domains › Add domain. Enter your domain (e.g. infra.example.com), then add the two CNAME records shown: *.infra.example.com CNAME <your-pam-subdomain>.border0.io _acme-challenge.infra.example.com CNAME <domain>.<your-pam-subdomain>.acme.border0.io Once DNS propagates, select Save. Your PAM HTTP service named wiki will be reachable at https://wiki.infra.example.com.
    • Adds a Make this the default domain option when registering multiple custom domains under Tailscale PAM, letting you designate which domain is primary for PAM HTTP services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

32. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) introduces managed privileged access to SSH, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., databases, Kubernetes, and more via the admin console⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Add a new PAM-managed SSH or database service to your tailnet so privileged access is brokered through Tailscale PAM.
    📍1. Open the Services page of the Tailscale admin console. 2. Select Add service, then PAM service. 3. Select a service type (e.g. SSH, PostgreSQL, RDP) and select Continue. 4. Follow the prompts and select a PAM connector for the service. 5. Select Save to activate the service.
    • Adds Tailscale PAM (beta), a Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. platform for controlling access to services on your tailnet through the Tailscale admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports SSH, HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., RDP, VNC, Kubernetes, and any TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port as PAM-managed service types.
    • Supports database service types including Amazon RDS, Elasticsearch, Google Cloud SQL, Microsoft SQL Server, MongoDB, MySQL, and PostgreSQL as PAM-managed resources.
    • Enables creating, updating, and deleting PAM services via the Services page in the Tailscale admin console, each bound to a PAM connector.

    4 details in Everything

33. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. connectors (beta) add identity-aware privileged access with session recording, policy validation, and secrets management to tailnets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces Tailscale PAM (beta), an identity-aware privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. layer integrated with Tailscale VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for securing access to private tailnet resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PAM connector as an application-aware identity proxy supporting SSH, database, and Kubernetes sessions between tailnet clients and services.
    • Supports session recording, policy validation, and secrets management via protocol-aware PAM connectors.
    • Provides high-availability connector deployment mode to account for single connector failures.

    4 details in Everything

34. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) adds privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. for SSH, databases, Kubernetes, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and HTTP services on your tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable Tailscale PAM and create a connector so privileged SSH access is proxied through your tailnet without manually configuring tags or approvals.
    📍1. In the Tailscale admin console, go to PAM and select Enable. 2. Go to Connectors, select Add connector, choose your platform (Linux, AWS EC2, Docker, or Kubernetes), and follow the Launch new connector instructions. 3. Go to Services, select Add service › PAM service › Secure Shell - Standard Shell, choose your connector, and select Save.
    Access a PAM-managed SSH or database service from a browser without installing the Tailscale client — useful for onboarding users or accessing services from unmanaged devices.
    📍1. In a browser, navigate to my.tailscale.com. 2. Log in with your Tailscale account. 3. Select the PAM service you want to access.
    • Enables Tailscale PAM from the PAM page in the Tailscale admin console, automatically creating the tag:border0-managed tag, an autoApprovers rule, an initial PAM application grant for autogroup:admin, and an OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. trust credential.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PAM connector support on Linux, AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., Docker, and Kubernetes to securely proxy sessions to PAM services.
    • Supports browser-based PAM service access at my.tailscale.com without requiring a Tailscale client installation.
    • Grants autogroup:admin members initial access to PAM services tagged with tag:border0-managed, covering SSH, databases, Kubernetes, RDP, and HTTP service types.
    • Adds Trust credentials page in the admin console to view OIDC trust credentials used by the Tailscale PAM API integration.

    +3 more show less

    • Introduces PAM Services page in the admin console for defining and managing secure PAM services, including Secure Shell - Standard Shell and database, HTTP, and RDP types.
    • Supports secret stores for securely storing upstream credentials when configuring PAM services.
    • Supports configurable PAM policies for defining granular access rules per service.

    8 details in Everything

35. docs update Sep 23, 2026 · issue 083

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta) adds identity-aware proxying, session recording/playback, credential injection, and a WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. browser client for agentless access⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Grant a specific user access to a PAM service (e.g., a PostgreSQL database) by referencing them in a grant in the tailnet policy file — the default is no access until explicitly granted.
    📍In the Tailscale admin console, go to Access controls to open the tailnet policy file, then add a grant referencing the user and the desired PAM service.
    • Manages PAM access policies through the tailnet policy file, editable in the Access controls page of the Tailscale admin console, with support for granular conditions: user identity, specific PAM services, device posture/MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., time (always or by request), and IP/country.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Tailscale PAM, a new Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. platform that securely proxies user sessions to services including SSH, HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., databases (Amazon RDS, Elasticsearch, Google Cloud SQL, Microsoft SQL Server, MongoDB, MySQL, PostgreSQL, Snowflake), Kubernetes, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., VNC, and arbitrary TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports.
    • Adds a PAM connector — an identity-aware application proxy deployed inside your infrastructure — that handles session termination, real-time policy enforcement, session recording, and secrets/credential injection.
    • Adds a WebAssembly-based browser client for agentless access to SSH, MySQL/Postgres databases, and RDP directly from the browser, with no client installation required.
    • Encrypts all connector-to-device tunnels with WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer., with automated tunnel creation and orchestration requiring no manual user setup.

    +1 more show less

    • Synchronizes Tailscale tailnet users and groups into Tailscale PAM automatically, mapping Tailscale roles (Owner, Admin, IT admin → Admin; Member, Billing admin → Client Access Only; Network admin, Auditor → Read Only) to three PAM roles: Admin, Client Access Only, and Read Only.

    6 details in Everything

36. docs update Sep 23, 2026 · issue 083

    Tailscale launches PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (beta): privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. with session auditing and recording for Linux servers, databases, and Kubernetes clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Tailscale PAM (beta), a Privileged Access Management solution providing application-aware, auditable access to Linux servers, databases, and Kubernetes clusters within a tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Provides complete session auditing and session recording for privileged access sessions governed through Tailscale PAM.

    2 details in Everything

37. docs update Sep 23, 2026 · issue 083

    Tailnet Lock lets trusted nodes cryptographically sign new peers so no node joins your tailnet without your approval, even if Tailscale infrastructure is compromised.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Sign a newly joined node from a trusted signing node so it can participate in the tailnet — supply the node key and Tailnet Lock public key shown in the admin console.
    copy

    $ tailscale lock sign nodekey:1abddef1 tlpub:abcdef12

    • Introduces tailscale lock init command to enable Tailnet Lock, generating ten disablement secrets and distributing trusted Tailnet Lock keys across the tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds tailscale lock sign command to sign a new node's key from a trusted signing node using its nodekey: and tlpub: identifiers.
    • Adds tailscale lock status command to verify the provisioned state of Tailnet Lock and confirm all nodes report the same set of trusted signing keys.
    • Adds tailscale lock disable command to disable Tailnet Lock using a stored disablement secret.
    • Adds tailscale lock local-disable command to make individual nodes ignore Tailnet Lock without a disablement secret, as a recovery option.

    +3 more show less

    • Adds property:locked-out filter in the Machines page of the admin console to find nodes awaiting a Tailnet Lock signature.
    • Supports signing new nodes via client app signing links on macOS, Windows, and iOS (with QR code support on iOS), as an alternative to the CLI.
    • Introduces the tailnet key authority (TKA), a cryptographic chain tracking trusted Tailnet Lock keys, enabling peer nodes to verify signatures before allowing connections.

    8 details in Everything

38. View device posture status (2026-09-23) Sep 23, 2026 · issue 083

    Tailscale admin console now shows per-machine posture assertion details and policy rule counts on the Machines page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Verify which posture assertions a specific machine is failing and how many policy rules depend on them, to diagnose access issues.
    📍In the admin console, go to Machines › select a machine › Device posture status. For each posture assertion, review the required value, the machine's current value, the pass/fail status, and the count of policy file rules that require that posture.
    • In the admin console, the Machines page now displays each posture assertion required by a device posture check, the machine's current value for that assertion, whether it is passing, and a count of policy file rules that affect the machine and require that posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

39. Tailscale GitHub Action v4.2.0 (2026-09-22) Sep 22, 2026 · issue 083

    Tailscale GitHub Action v4.2.0 adds log-mode parameter to control grouped, ungrouped, or quiet log output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

40. announced Sep 9, 2026 · issue 070

    Tailscale Kubernetes Operator 1.102 adds in-cluster PeerRelay CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. egress for ProxyGroup, and Let's Encrypt cert optimizations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Deploy a highly-available in-cluster peer relay in a VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.-isolated cluster to facilitate direct cross-cluster connections without manual Tailscale client configuration.
    yaml copy

    apiVersion: tailscale.com/v1alpha1
    kind: PeerRelay
    metadata:
      name: my-relay
    spec:
      replicas: 2

    • Adds a new PeerRelay custom resource (apiVersion: tailscale.com/v1alpha1, kind: PeerRelay) so the Kubernetes Operator can deploy and manage in-cluster Tailscale peer relays automatically, with support for spec.replicas, tags, proxyClass inheritance, and tailnet configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds IPv6 destination support to ProxyGroup Egress, enabling egress to IPv6-only destinations including 4via6 subnet routers — previously only IPv4 destinations were valid.
    • Cert issuance for multiple domains now runs in parallel instead of serially, preventing provisioning of many domains from stalling behind each other.
    • During Ingress deletion, VIPServices are now blocked from acquiring new certificates, avoiding wasting Let's Encrypt rate-limit quota in ephemeral deployments.
    • Adds a new PeerRelay custom resource (apiVersion: tailscale.com/v1alpha1, kind: PeerRelay) so the Kubernetes Operator can deploy and manage in-cluster Tailscale peer relays automatically, with support for spec.replicas, tags, proxyClass inheritance, and tailnet configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

41. announced Aug 31, 2026 · issue 060

    Tailscale releases tailcat, a netcat-like CLI and Go package using Tailscale's WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. data plane with no accounts, IPs, or control plane

    • New tailcat CLI tool and open-source Go package lets two machines exchange bidirectional bytes over Tailscale's magicsock (WireGuard + NAT traversal + DERP relay) with no Tailscale account, no IP addresses visible to users, and no OS-level networking changes (no TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. devices, no routing table modifications).
    • Client mode supports running a child process (e.g. curl) with an ephemeral local SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy via an environment variable, letting tailcat-oblivious programs use the encrypted tunnel transparently.
    • Supports optional key locking so the server can restrict which client public keys are permitted to connect.
    • Supports specifying a custom DERP server (e.g. a self-hosted cmd/derper instance) for full independence from Tailscale infrastructure; falls back automatically to Tailscale-hosted, rate-limited DERP relays when direct UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. NAT traversal fails.
    • Keypairs can be ephemeral or named and reused across sessions.

    5 details in Everything

42. announced Aug 28, 2026 · issue 058

    Tailscale now offers DNS filtering via Control D, with per-device/group rules applied through ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. nodeAttrs

    └──▷ USE IT
    Apply a Control D DNS filtering rule to all employees in your tailnet to block malicious and phishing domains.
    json copy

    {
      "nodeAttrs": [
        {
          "target": ["group:employees"],
          "attr": [
            "controld:o13v9z7zns"
          ]
        }
      ]
    }

    Add Control D as a nameserver to your tailnet via the Tailscale admin console to route DNS through Control D's filtering infrastructure.
    📍In the Tailscale admin console, go to DNS › Nameservers and add Control D as a nameserver. Then open your Control D dashboard to assign or create a filtering rule.
    • Adds DNS filtering by Control D as a purchasable add-on, integrable into a tailnet with per-group or per-device controls via the nodeAttrs ACL attribute (e.g., controld:<rule-id>).
    • Supports mapping Control D filtering rules to Tailscale users, groups (group:), tags, or individual devices through the existing Tailscale ACL file.
    • DNS queries from covered devices are routed through Control D over encrypted DNS, enforcing the assigned filtering ruleset (malware, phishing, content categories, custom block/allow/redirect rules).
    • Control D rules remain manageable through the Control D Dashboard or API independently of Tailscale.

    4 details in Everything

43. changelog Aug 28, 2026 · issue 058

    Tailscale adds PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., Aperture AI gateway, and a new TS_BOOT_TIMEOUT env var for containers

    └──▷ TRY IT
    Extend container startup grace period in slow or heavily loaded environments where the coordination server connection takes longer than the default 60 seconds.
    copy

    $ TS_BOOT_TIMEOUT=3m docker run --rm -e TS_BOOT_TIMEOUT=3m tailscale/tailscale

    Set TS_BOOT_TIMEOUT in a Kubernetes deployment so the sidecar container waits 90 seconds before failing on slow cluster network initialization.
    yaml copy

    env:
      - name: TS_BOOT_TIMEOUT
        value: "90s"

    • New TS_BOOT_TIMEOUT environment variable controls how long the Tailscale container waits for its initial connection to the coordination server; accepts durations like 90s or 3m, defaulting to 60s.
    • Introduces Tailscale Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (PAM) beta, supporting database, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. service types with session recording for SSH, database, HTTPS, and Kubernetes Service types.
    • PAM policies can be set for user access and in-service permissions through grants, with secrets store integration for credential injection.
    • PAM sessions can be recorded and played back; audit logs of user access are available.
    • PAM connectors can be managed and deployed to provide connectivity to services.

    +11 more show less

    • Browser client allows access to PAM services without requiring a Tailscale client download.
    • Custom domain management is available for public HTTP PAM services.
    • Custom Amazon S3 bucket can be configured for PAM recording storage.
    • Service accounts can be created for machine identities to interact with the PAM API.
    • Introduces Aperture gateway for securing and managing AI agents and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. sessions, with cost controls, request/response hooks, guardrails, logging, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and API proxying.
    • Aperture exposes a Tailscale MCP endpoint and an SSH MCP endpoint, allowing coding agents and tailnet nodes to be added or accessed after user approval.
    • Chat Projects in Aperture enable sharing of instructions, tool access, and tailnet nodes in group chats.
    • Default tool permissions can be defined across Aperture chats for baseline tool access.
    • Model tokens for major AI models can be purchased directly in Aperture.
    • Peer relays on AWS now use HTTP instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. for pod health checks, preventing all targets from being reported as unhealthy.
    • Peer relays on AWS are reachable regardless of the availability zone their pod is scheduled in; pinning Elastic IPs requires pinning pods to the same zone using a Network Load Balancer.

    16 details in Everything

44. announced Aug 27, 2026 · issue 058

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. beta brings privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. — session logs, recordings, JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. access, and connector management — into the Tailscale admin console.

    • New Tailscale PAM (privileged access management) product, now in beta, available through the Tailscale admin console for managing privileged access alongside network connectivity.
    • Supports just-in-time access requests and approvals via Slack, scoped to a specific resource and time window, reducing standing access to production infrastructure.
    • Enables per-service access policies controlling users, groups, time windows, and permissions — finer-grained than subnet-level network access.
    • Supports session logs and session recordings for SSH, Kubernetes API, databases, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and browser-based sessions to support compliance and incident investigations.
    • Provides browser-based access for contractors and external users without requiring a desktop client installation.

    +1 more show less

    • Connectors can be deployed inside private environments without installing agents on each individual resource, managed and monitored from the Tailscale admin console.

    6 details in Everything

45. announced Aug 26, 2026 · issue 058

    Tailscale Aperture GA adds built-in token purchasing, two new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoints (Tailscale and Tailscale SSH), Projects, and per-chat tool permissions.

    └──▷ HOW TO FIND IT
    When you want an AI agent to deploy a service to a tailnet node and configure SSH access without manually copying keys, use the new Tailscale SSH MCP endpoint through Aperture.
    📍In Aperture, go to MCP Endpoints, enable the Tailscale SSH MCP, then open a chat and instruct your agent to access a named tailnet node via Tailscale SSH — Aperture will prompt you to approve any new machine before the agent proceeds.
    When running recurring project work (e.g. homelab automation), create a Project in Aperture to share instructions, tool access, and tailnet nodes across all related chats so you stop re-prompting context each session.
    📍In Aperture, go to Projects › New Project, set shared initial instructions and select the tailnet nodes and tools this project's chats may access, then open chats inside the project to inherit those defaults.
    • Adds two new MCP endpoints — Tailscale and Tailscale SSH — letting Aperture and coding agents add nodes to a tailnet and access them via Tailscale SSH without manually distributing keys.
    • New Projects feature in the Aperture chat interface groups chats with shared instructions, tool access, and tailnet nodes, reducing per-chat re-prompting.
    • New ability to define default tool permissions across all Aperture chats, controlling which tools agents can reach by default.
    • New Aperture instances now include initial tokens for major models (open-weight and closed); additional tokens can be purchased directly inside Aperture without supplying third-party API keys.

    4 details in Everything

46. Tailscale PAM (2026-08-26) Aug 26, 2026 · release notes

    Tailscale PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. beta launches with service definitions, session recording, and browser client access for privileged management.

    └──▷ HOW TO FIND IT
    Allow team members to manage privileged sessions via their browser, eliminating the need for the Tailscale desktop or mobile app.
    📍Navigate to PAM › Services in the console and enable Browser Client Access for your service definition.
    • PAM now supports defining SSH, database, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., Kubernetes, and Amazon S3 service types for privileged access
    • Sessions for SSH, database, HTTPS, and Kubernetes services are recorded, with playback capability in the UI
    • Browser client allows access to PAM services without requiring a Tailscale client download

    3 details in Everything

47. changelog Aug 19, 2026 · issue 050

    Tailscale's list tailnets API endpoint now paginates results with limit and cursor query parameters.

    └──▷ TRY IT
    Page through all tailnets in a large organization by following the returned cursor until it is empty.
    copy

    $ curl -H 'Authorization: Bearer <api-token>' 'https://api.tailscale.com/api/v2/tailnets?limit=100'
    # Use the returned cursor value in subsequent requests:
    curl -H 'Authorization: Bearer <api-token>' 'https://api.tailscale.com/api/v2/tailnets?limit=100&cursor=<cursor>'

    • Adds pagination to the list tailnets API endpoint via limit and cursor query parameters, returning up to 100 results per page by default and a totalCount in the response.
    • Returns a cursor value in the list tailnets response to pass as the cursor query parameter on subsequent requests; iteration ends when the returned cursor is empty.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The list tailnets endpoint now returns only the first 100 results by default for organizations with more than 100 tailnets; callers that previously received all tailnets in a single response must now paginate using the cursor parameter to retrieve the full set.
48. Tailscale container image v1.102.3 (2026-08-19) Aug 19, 2026 · issue 051

    Tailscale container image v1.102.3 adds TS_BOOT_TIMEOUT env var to extend initial coordination server connection wait.

49. Tailnet list API pagination (2026-08-18) Aug 18, 2026 · issue 050

    Tailnet list API now paginates with limit and cursor query parameters, returning 100 results per page by default.

    └──▷ TRY IT
    Page through all tailnets in a large organization by following the returned cursor until it is empty.
    copy

    $ curl -H 'Authorization: Bearer <api_key>' 'https://api.tailscale.com/api/v2/tailnets?limit=100&cursor=<cursor>'

    └──▷ BREAKING ON UPGRADE

    • !The list tailnets endpoint now returns only the first 100 results by default for organizations with more than 100 tailnets; callers that previously received all tailnets in a single response must now page through results using the cursor parameter.
50. changelog Aug 12, 2026 · issue 043

    Tailscale operator gains in-cluster PeerRelays via custom resource, Helm annotation support, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. egress on dual-stack clusters.

    • PeerRelays are now deployable in-cluster via a Kubernetes custom resource.
    • Per-attempt cert issuance timeout in Kubernetes proxies is increased to 30 minutes, enabling ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. challenges to complete under load.
    • MTU values are now clamped on both input and output interfaces (previously only the output interface was clamped).
    • Exposes tailscale_dns_split_nameservers and tailscale_users metrics.

    4 details in Everything

51. Tailscale Kubernetes Operator v1.102.2 (2026-08-11) Aug 11, 2026 · issue 042

    Tailscale Kubernetes Operator v1.102.2 adds in-cluster PeerRelays, workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. federation, 4via6 support, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Egress ProxyGroups.

    • Supports deploying PeerRelays in-cluster via a new custom resource.
    • Adds workload identity federation configuration for the Tailnet custom resource.
    • Supports 4via6 in connector and egress proxy resources when egressing from a dual-stack cluster.
    • Supports IPv6 in Egress ProxyGroups.
    • Adds ability to apply annotations to the operator's deployment resource via Helm.

    +1 more show less

    • Reduces operator log noise by excluding superfluous entries for resources that do not contain annotations.

    6 details in Everything

52. Tailscale v1.102.1 (2026-08-03) Aug 3, 2026 · issue 035

    Tailscale v1.102.1 adds four new CLI commands, new client metrics, iOS/tvOS UI upgrades, and macOS deep-linking.

    └──▷ TRY IT
    Inspect the current node's configured preferences from the command line.
    copy

    $ tailscale get

    Identify the currently authenticated user and device without opening the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    copy

    $ tailscale whoami

    List all Tailscale Services visible to this node to audit what's being exposed on the tailnet.
    copy

    $ tailscale service list

    • New tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections.
    • New tailscale get CLI command returns the current node's preferences.
    • New tailscale whoami CLI command displays information about the current user and device.
    • New tailscale service list CLI command lists Tailscale Services visible to the current node.
    • New macOS protocol handler supports deep-linking to devices, exit nodes, and settings panels in the application window.

    +10 more show less

    • New assembly crypto routines for 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. on Linux improve cryptographic performance on those platforms.
    • New split-plane layout on iPad (portrait and landscape) and wide iPhones (landscape) for the iOS app.
    • New iOS status widget supports toggling the active exit node inline.
    • New Tailscale web client support for remote management of Apple TV devices on tvOS.
    • Node additions and removals are now processed in constant time, significantly reducing CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage on large tailnets.
    • Tailscale Funnel domains switch to TLS-ALPN-01 for faster HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. certificate renewals.
    • TLS certificates on idle servers now proactively auto-renew in the absence of traffic, with warnings issued when no valid cached certificate exists.
    • Exit node names appear as subtitles in Shortcuts on macOS and iOS and can be used to filter the displayed exit node list.
    • Userspace TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. optimizations on Linux improve throughput and performance.
    • Synology RMv7 binaries with software floating point are now produced for certain NAS models, replacing older ARMv5 binaries.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated formats for 4via6 MagicDNS names are no longer available.
53. Tailnet creation API (2026-07-29) Jul 29, 2026 · issue 030

    New alpha API lets you programmatically create, list, and delete API-only tailnets in your organization.

54. 1.94.1 Jan 27, 2026 · release notes

    Tailscale v1.94.1 introduces log streaming to Google Cloud Storage and GA for Tailscale Services.

    • Adds log_streaming integration with Google Cloud Storage
    • Promotes Tailscale Services to General Availability (GA)
    • Adds tsnet integration support for Tailscale Services

    3 details in Everything

55. 1.84.2 Jun 9, 2025 · release notes

    App connectors reach general availability and new safeguards prevent accidental tailnet policy changes.

    • App connectors are now generally available for production use in v1.84.2
    • New UI safeguards prevent accidental modification of the tailnet policy file

    2 details in Everything

56. v1.70.0 Jul 17, 2024 · release notes

    Tailscale v1.70 adds split tunneling on Android, health notifications on macOS, Siri/Shortcuts DNS toggle, and new exit node MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.70.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.70.0

    └──▷ HOW TO FIND IT
    Check reachability of a tailnet device from an Android phone without leaving the app.
    📍In the Tailscale Android app, go to the devices list, long-press on a device, and select Ping to view ping latency and connection status.
    • New AllowedSuggestedExitNodes system policy (all platforms with MDM support) restricts which exit nodes Tailscale recommends or auto-selects.
    • New auto:any value for the ExitNodeID system policy automatically selects an exit node on Windows, macOS, iOS, and tvOS (Enterprise plan only).
    • macOS client now surfaces health notifications in the menu — covering connectivity loss, firewall blocks, and misconfigurations — and changes the menubar icon to show an exclamation mark when connectivity is affected.
    • macOS client warns users when the built-in macOS content filter (Screen Time) is blocking Tailscale from connecting.
    • On MacBooks with a display notch, a notification window appears when the Tailscale menubar icon is hidden behind the notch.

    +3 more show less

    • Toggle Tailscale DNS via Siri or the Shortcuts app on macOS and iOS.
    • Android app adds a Ping view: long-press a device in the devices list and select Ping to access ping information and connection status.
    • Android app gains split tunneling support to force or exclude per-app traffic through the tailnet.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tailscale v1.70 is the last version to support macOS 10.15 Catalina; macOS 10.15 will not be supported in future releases.
57. v1.68.0 Jun 12, 2024 · release notes

    v1.68.0 adds tailscale lock status node signature display, macOS DHCP misroute detection, and Taildrop file-received notifications.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.68.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.68.0

    └──▷ USE IT
    Check the current tailnet lock configuration and view the node's signature to verify authentication status.
    shell copy

    tailscale lock status

    • Tailscale detects any attempt to use DHCP Option 121 to misroute traffic meant for the VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. (TunnelVision attack) on macOS and presents a warning
    • System administrators can disable the TunnelVision warning on macOS with a system policy
    • The Standalone variant of Tailscale now supports notifications when a file is received using Taildrop

    3 details in Everything

58. v1.66.3 May 14, 2024 · release notes

    Kubernetes ProxyClass CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. adds labels, affinity, env vars, metrics, and ingress/egress service exposure.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.66.3 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.66.3

    └──▷ USE IT
    Label proxy Pods and set environment variables using ProxyClass
    yaml copy

    api:
    ---
    apiVersion: tailscale.com/v1alpha1
    kind: ProxyClass
    metadata:
      name: my-proxy
    spec:
      template:
        metadata:
          labels:
            sidecar.istio.io/inject: 'false'
        spec:
          containers:
          - name: tailscale
            env:
            - name: TS_EXTRA_ARGS
              value: '--no-ndp'

    Exposes an external RDS instance to the tailnet via Kubernetes ExternalName Service
    yaml copy

    api:
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: rds-db
    spec:
      type: ExternalName
      externalName: <rds-instance-name>.<region>.redshift.amazonaws.com

    • ProxyClass CRD supports labels, affinity, and env fields for proxy Pods
    • ProxyClass exposes a tailscaled metrics endpoint via the new .spec.metrics field
    • Cluster workloads can now refer to Tailscale Ingress resources by their MagicDNS names
    • ExternalName Services in the cluster expose cloud services to the tailnet
    • Tailscale HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. services are exposed from the tailnet to cluster workloads

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Kubernetes operator must always run the same or later version as the proxies it manages
59. v1.66.1 May 9, 2024 · release notes

    Tailscale v1.66.1 adds three new flags to the tailscale set CLI command on Linux.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.66.1 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.66.1

    └──▷ USE IT
    Configure stateful filtering mode via CLI without using interactive prompts.
    shell copy

    tailscale set --netfilter-mode=auto --stateful-filtering=yes

60. v1.66.0 May 8, 2024 · release notes

    New tailscale exit-node suggest CLI command and --stateful-filtering default changes for subnet routers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.66.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.66.0

    └──▷ HOW TO FIND IT
    Configure a new subnet router with the correct flags for stateful filtering requirements in v1.66.
    📍tailscale up --snat-subnet-routes=false --stateful-filtering=false
    • Adds the tailscale exit-node suggest subcommand to automatically select the best available exit node
    • Adds a Bug Report identifier feature accessible via About Tailscale > Report an issue on tvOS
    • Adds DNS configuration management to the DNS Settings view on tvOS

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !New subnet routers require --stateful-filtering=false in addition to --snat-subnet-routes=false; existing routers with --snat-subnet-routes=false now default to --stateful-filtering=false
    • !Subnet routers and exit nodes enabled via tailscale up now have stateful filtering active by default unless --stateful-filtering=false is explicitly set
61. v1.64.0 Apr 13, 2024 · release notes

    Tailscale v1.64.0 adds standalone SSH/NC clients, synology-cert CLI, and kubeconfig env support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.64.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.64.0

    └──▷ USE IT
    Configure kubeconfig using an explicit env var path.
    shell copy

    KUBECONFIG=/path/to/config tailscale configure kubeconfig

    • tailscale ssh and tailscale nc are now supported in the Standalone variant of the client.
    • New Internet Access Policy for Little Snitch users on macOS
    • Receive alerts when an error occurs while changing client preferences on macOS
    • tailscale serve headers are now RFC 2047 Q-encoded
    • Update certificates using the configure synology-cert CLI command on Synology

    +1 more show less

    • tailscale configure kubeconfig now respects KUBECONFIG environment variable.

    6 details in Everything

62. v1.62.1 Mar 26, 2024 · release notes

    Adds load balancing hint HTTP request header on Linux for traffic steering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.62.1 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.62.1

    └──▷ TRY IT
    Send a hint to the Tailscale web server for load balancing decisions.
    copy

    $ curl -H 'X-Tailscale-Load-Balancing-Hint: primary' https://my-machine.tailscale.example

63. v1.62.0 Mar 13, 2024 · release notes

    v1.62.0 adds MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. key support for Windows policy management and macOS .pkg standalone installer

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.62.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.62.0

    • ManagedByOrganizationName, ManagedByCaption, and ManagedByURL system policy keys are now supported on Windows
    • A .pkg installer package is now available for the Tailscale client standalone release on macOS

    2 details in Everything

64. v1.60.0 Feb 15, 2024 · release notes

    v1.60.0 introduces macOS VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. On-Demand, ProxyClass K8s CR, and read-only web client mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.60.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.60.0

    • Adds ProxyClass custom resource to the Kubernetes operator for cluster-specific configuration
    • Enables configurable ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. tags in the Helm chart values for the Kubernetes operator
    • Introduces VPN On-Demand support on macOS to trigger connections based on conditions
    • Adds a Reset VPN Configuration menu item in the macOS Debug Menu
    • Adds a new read-only mode to the Tailscale web client

    +3 more show less

    • Adds support for pre-configured routes from the control server in app connectors
    • Allows app connectors to install routes for domains resolving to CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. records
    • Enables detection of Digital Ocean DNS resolvers when running on cloud servers

    8 details in Everything

65. v1.58.0 Jan 18, 2024 · release notes

    Tailscale v1.58.0 adds Kubernetes Connector CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., macOS DNS view, and --webclient flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.58.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.58.0

    └──▷ USE IT
    Deploy a subnet router using the new Kubernetes Connector resource.
    yaml copy

    ---
    apiVersion: tailscale.com/v1
    kind: Connector
    metadata:
      name: my-subnet-router
    spec:
      # ... Connector spec ...

    Enable the web client via CLI on supported platforms.
    shell copy

    tailscale set --webclient=true

    • Adds Connector Custom Resource to deploy subnet routers and exit nodes via the Kubernetes Operator
    • Adds Tailscale IngressClass resource for controlled ingress routing in Kubernetes
    • Syncs operator-managed labels to StatefulSet Pods automatically
    • Displays a new DNS Settings view in the macOS app showing configuration during runtime
    • Adds Option-click Quit (Leave VPN Active) option to quit the macOS app while keeping the tunnel active

    +1 more show less

    • Supports KeyExpirationNotice system policy on macOS and iOS to customize key expiration notifications

    6 details in Everything

66. v1.56.0 Dec 13, 2023 · release notes

    New tailscale whois subcommand and GoKrazy defaults; improved profiles and Taildrop for mobile/macOS

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.56.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.56.0

    └──▷ USE IT
    Inspect metadata for a specific Tailscale IP address directly from the terminal.
    shell copy

    tailscale whois <tailnet_ip>

    List available profiles to identify unique IDs for switching or scripting purposes.
    shell copy

    tailscale switch --list

    • Adds the tailscale whois subcommand to observe metadata associated with a Tailscale IP address.
    • Includes tailnet name and profile ID in tailscale switch --list output to disambiguate profiles with common login names.
    • Adds tvOS UI components for configuring subnet router routes, allowing the device to act as a network segment gateway.
    • Adds Allow Local Network Access option to the exit node picker UI on iOS.

    4 details in Everything

67. v1.54.0 Nov 15, 2023 · release notes

    Tailscale v1.54.0 adds MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. settings support, macOS CLI update flag, and improved UX/UX features across platforms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.54.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.54.0

    • Adds Allow Local Network Access toggle setting in the iOS client when using an exit node
    • Enables regular left-click menu opening in the Tailscale system tray on Windows

    2 details in Everything

68. v1.52.0 Oct 30, 2023 · release notes

    Tailscale v1.52 adds tailscale update beta, WoL for peers, speculative TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. DNS, and system policy controls

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.52.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.52.0

    • Adds tailscale update command (beta) for manual client updates
    • Adds --auto-update flag to tailscale set across Linux, Windows, and macOS for opt-in automatic client updates
    • Adds Wake on LAN support for peer node wake-ups
    • Enables speculative TCP DNS queries when UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. response is slow
    • Enables retry of truncated UDP DNS results via TCP

    +5 more show less

    • Updates [tailscale serve](https://tailscale.com/kb/1242/tailscale-serve) and [tailscale funnel](https://tailscale.com/kb/1311/tailscale-funnel) commands for improved usability
    • Adds System policy support to control tailnet name, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. stop prevention, and UI hiding
    • Enables DNS support on tvOS when acting as an exit node
    • Allows Taildrop to resume interrupted file transfers
    • Adds progress meter display to Taildrop file transfers on Linux

    10 details in Everything

69. v1.50.0 Sep 25, 2023 · release notes

    Adds Wikimedia DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. support, tailscale update visibility, and tvOS platform support in v1.50.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.50.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.50.0

    └──▷ USE IT
    Debug Portmapper HTTP interactions by enabling verbose logging for tailscale debug portmap
    shell copy

    tailscale debug portmap --log-http

    • Adds support for Wikimedia DNS using DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. to resolve Tailscale's DNS names
    • Unhides the tailscale update CLI command on most platforms, making it explicitly available for manual updates
    • Adds --log-http option to tailscale debug portmap to enable HTTP logging for Portmapper debugging
    • First official release with support for tvOS platform

    4 details in Everything

70. v1.48.0 Aug 16, 2023 · release notes

    Tailscale v1.48.0 adds tailscale exit-node subcommand, Linux nftables support, and Tailscale Lock Beta.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.48.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.48.0

    └──▷ TRY IT
    View the current upstream DNS resolver configuration alongside version details.
    copy

    $ tailscale version --upstream=8.8.8.8

    Enable Tailscale Funnel via the interactive web UI to expose a local service to the internet securely.
    📍tailscale funnel http :8080
    • Introduces the tailscale exit-node subcommand to manage exit node configuration
    • Adds --upstream flag to tailscale version for specifying a DNS resolver upstream
    • Enables Linux nftables support in addition to iptables
    • Introduces Tailscale Lock Beta for device security policies
    • Adds interactive web UI prompts within tailscale funnel and tailscale serve to enable Tailscale Funnel and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.

    5 details in Everything

71. v1.46.0 Jul 19, 2023 · release notes

    Tailscale v1.46.0 adds Tailnet lock support to iOS, macOS, and Windows clients.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.46.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.46.0

    └──▷ HOW TO FIND IT
    Enable device-level security controls via the macOS GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    📍In the Tailscale menu bar app, navigate to Settings and enable Tailnet lock.
    Enable device-level security controls via the iOS GUI.
    📍In the Tailscale iOS app, go to Settings › Security and toggle Tailnet lock.
    • Tailnet lock support added to iOS client
    • Tailnet lock support added to macOS client
    • Tailnet lock support added to Windows client

    3 details in Everything

72. v1.44.0 Jun 21, 2023 · release notes

    Tailscale v1.44.0 adds SSH remote port forwarding, HTTP Serve, and recursive DNS resolution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.44.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.44.0

    • Adds HTTP protocol support to Tailscale Serve for web services
    • Introduces recursive DNS resolution mode in parallel with existing bootstrapDNS
    • Changes certificate renewal logic in tailscale cert to use actual certificate lifetime instead of hard-coded values

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The portlist package removes async support; synchronous Poll() must be used instead
73. v1.42.0 May 24, 2023 · release notes

    Adds tailscale serve reset command, Unraid NAS platform support, and Kubernetes priorityClassName configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.42.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.42.0

    └──▷ USE IT
    Clear the current Tailscale serve configuration without manually editing files.
    shell copy

    tailscale serve reset

    • Add tailscale serve reset subcommand to clear current serve config
    • Support Unraid as a NAS platform for Taildrop file delivery
    • Add priorityClassName configuration option for Kubernetes deployments

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tailscale releases after v1.42 will no longer install on Windows 7, Windows 8, Windows Server 2008, Windows Server 2012, macOS 10.13 High Sierra, or macOS 10.14 Mojave
74. v1.40.1 May 11, 2023 · release notes

    Tailscale v1.40.1 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./user support for Tailscale SSH and restores local file recording.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.40.1 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.40.1

    • Adds LDAP and other users with Tailscale SSH

    1 detail in Everything

75. v1.40.0 Apr 26, 2023 · release notes

    Tailscale v1.40.0 adds Android VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. intents, SSH risk flag, and performance improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.40.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.40.0

    └──▷ USE IT
    Force re-authentication on a remote machine over SSH while accepting the risk of losing that specific SSH session.
    shell copy

    tailscale up --force-reauth --accept-risk=lose-ssh

    Programmatically connect the Tailscale VPN using an Android intent in a script or automation.
    shell copy

    adb shell am start -a com.tailscale.ipn.CONNECT_VPN

    • tailscale up --force-reauth now shows a 5-second countdown when connected over SSH over Tailscale unless --accept-risk=lose-ssh is provided.
    • Added Android intents com.tailscale.ipn.CONNECT_VPN and com.tailscale.ipn.DISCONNECT_VPN for programmatic VPN control.

    2 details in Everything

76. v1.38.4 Apr 5, 2023 · release notes

    Tailscale v1.38.4 adds path support to tailscale serve proxy targets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.38.4 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.38.4

77. advisory CVE-2023-28436 Mar 22, 2023 · issue 128
    • CVE-2023-28436: Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.7, affects >=1.34.0, <1.38.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
78. v1.38.1 Mar 14, 2023 · release notes

    Tailscale v1.38.1 adds tailscale serve, funnel, and several debug subcommands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.38.1 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.38.1

    • Adds the tailscale serve command to manage local proxying rules, moving Funnel functionality into a dedicated command.
    • Adds tailscale funnel as a new subcommand for controlling public access to locally running services.
    • Adds tailscale debug portmap, tailscale debug derp, and tailscale debug capture commands for diagnosing connectivity and capturing pcapspcapsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
    • Adds tailscale configure command to help third-party applications integrate with Tailscale features.
    • Allows tailnet-lock to be used with preauth keys for bootstrapped machine authentication.

    5 details in Everything

79. v1.36.0 Jan 24, 2023 · release notes

    Adds tailscale debug daemon-logs, JSON output flags, Shortcuts app integration, and Loongnix/EOIP support in v1.36.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.36.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.36.0

    └──▷ USE IT
    Export daemon logs for debugging without leaving the CLI.
    shell copy

    tailscale debug daemon-logs

    Get machine-readable version info for scripting or CI checks.
    shell copy

    tailscale version --json

    Automate Tailscale connection actions on macOS using the Shortcuts app interface.
    📍In the Shortcuts app, add a Tailscale action such as Connect, Disconnect, or Switch Profile.
    • Adds the tailscale debug daemon-logs command for exporting daemon logs.
    • Supports arbitrary IP protocols like EOIP and GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation..
    • Adds a build target for the Loongnix CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architecture on Linux.
    • Enables Tailscale actions (connect, disconnect, switch profile, use exit node) in the macOS Shortcuts app via steps UI navigation.
    • Enables Tailscale actions (connect, disconnect, use exit node) in the iOS Shortcuts app via steps UI navigation.

    +3 more show less

    • Adds JSON output mode to tailscale version, tailscale lock status, and tailscale lock log.
    • Adds KeyExpiry time and Expired boolean fields to tailscale status --json output.
    • Supports UPnP port mapping for gateway devices deployed as a highly available pair.

    8 details in Everything

80. v1.34.0 Dec 5, 2022 · release notes

    Tailscale v1.34.0 adds tailscale lock, tailscale set, Fast User Switching (login/switch), and 4via6 DNS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.34.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.34.0

    • tailscale lock command to manage tailnet lock
    • add tailscale set CLI to modify one configuration setting without needing to repeat the rest
    • a new (third) 4via6 DNS form: 192-168-1-2-via-8 or 192-168-1-2-via-8.foo-bar.ts.net.
    • display decoded punycode hostnames in status list

    4 details in Everything

81. advisory CVE-2022-41924 Nov 21, 2022 · issue 128
    • CVE-2022-41924: Tailscale Windows daemon is vulnerable to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <1.32.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
82. v1.32.0 Oct 12, 2022 · release notes

    NextDNS support, tailscale bugreport --record, new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. helper, and NextDNS/diagnostic enhancements in v1.32.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.32.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.32.0

    └──▷ TRY IT
    Run tailscaled without collecting usage statistics or logs, suitable for privacy-conscious deployments.
    copy

    $ tailscaled --no-logs-no-support

    Pause a diagnostic bug report while capturing network state for later analysis.
    copy

    $ tailscale bugreport --record

    • Add tailscaled --no-logs-no-support flag or TS_NO_LOGS_NO_SUPPORT=true environment variable to disable logging and support data collection.
    • Add --record argument to tailscale bugreport command to pause diagnostic recording and write an intermediate report.
    • Add NextDNS support for DNS configuration across all platforms.
    • Add eBPF helper in Linux builds to pass the first packet of a new flow up to tailscaled.
    • Add captive portal detection via tailscale netcheck.

    +1 more show less

    • Update bugreport output with more in-depth healthchecks.

    6 details in Everything

83. v1.30.0 Aug 31, 2022 · release notes

    v1.30.0 adds tailscale licenses subcommand, OpenBSD hybrid netstack support, and Android coordination server URL setting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.30.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.30.0

    └──▷ TRY IT
    View the open source licenses included in your Tailscale installation directly from the CLI.
    copy

    $ tailscale licenses

    Configure a custom coordination server URL on Android by accessing the hidden menu option.
    📍Click the Authentication menu three times quickly to enable setting the coordination server URL.
    • Adds tailscale licenses subcommand to display open source license links
    • Adds Android coordination server URL configuration accessible via the Authentication menu
    • Enables OpenBSD to function as a subnet router or exit node using hybrid netstack mode
    • Supports Noise protocol on any HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. port for clients with capver 39

    4 details in Everything

84. v1.28.0 Jul 18, 2022 · release notes

    Tailscale v1.28.0 adds MagicDNS TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. support, ExitNodeStatus JSON field, and Android exit node capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.28.0

    └──▷ TRY IT
    Check exit node status programmatically via JSON output.
    copy

    $ tailscale status --json | jq '.ExitNodeStatus'

    Configure an Android device as an exit node via the UI.
    📍In the Tailscale app on Android, go to Settings and enable Exit Node.
    • Adds ExitNodeStatus field to tailscale status --json output for programmatic monitoring of exit node state.
    • Enables MagicDNS support for TCP traffic.
    • Allows Android devices to function as an Exit Node.
    • Improves iOS 15+ memory availability and updates minimum OS requirement to iOS 15.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum supported iOS version is now iOS 15.
85. v1.26.0 Jun 6, 2022 · release notes

    New tailscale ping --peerapi command, PeerAPI Wake-on-LAN, and --timeout flag for tailscale up

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.26.0

    └──▷ USE IT
    Verify reachability of a specific peer node using the PeerAPI protocol.
    shell copy

    tailscale ping --peerapi 100.x.y.z

    Prevent tailscale up from hanging indefinitely during service initialization by setting a hard timeout.
    shell copy

    tailscale up --timeout 5s

    • Adds tailscale ping --peerapi <peer> to check connectivity to a peer using the PeerAPI
    • Adds Wake-on-LAN function to PeerAPI
    • Adds --timeout <duration> flag to tailscale up to enforce a maximum amount of time to wait for the Tailscale service to initialize

    3 details in Everything

86. v1.24.0 Apr 22, 2022 · release notes

    v1.24.0 adds ts2021 protocol, tsnet StateStore support, site-relative IPv4 addressing, MagicDNS PTR records, and improved Taildrop file handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.24.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.24.0

    • Deploys the ts2021 protocol as the first stable version of the new connection handshake.
    • Adds initial support for site-relative IPv4 addressing using IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. to control client IP assignment.
    • Enables MagicDNS to return PTR records for TS service IPs, resolving hostnames to their internal addresses.
    • Allows tsnet applications to provide a custom ipn.StateStore implementation.
    • Adds --loop and --conflict=(skip|overwrite|rename) flags to the taildrop file get command on Linux.

    5 details in Everything

87. v1.22.0 Feb 23, 2022 · release notes

    v1.22.0 adds ephemeral node mode via --state=mem: and new tailscale status --json fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.22.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.22.0

    └──▷ TRY IT
    Run a temporary tailnet node that cleans itself up on exit without leaving state files.
    copy

    $ sudo tailscaled --state=mem: &

    • tailscaled --state=mem: registers as an ephemeral node and does not store state to disk
    • New: DERP Return Path Optimization (DRPO) reduces connection latency between nodes in different DERP regions by requiring only one side to connect
    • tailscale status --json now includes Tags and PrimaryRoutes fields for peers
    • New optional TS_PERMIT_CERT_UID environment variable allows non-root users to fetch Tailscale TLS certificates
    • tailscale status --json | jq .TailnetName enables programmatic retrieval of the tailnet name

    +2 more show less

    • New Windows MSI installer available for standard deployment
    • --auth-key and --authkey are now both accepted as valid arguments for tailscale up

    7 details in Everything

88. v1.20.0 Jan 13, 2022 · release notes

    v1.20.0 adds JSON output flags to CLI commands and enhances exit node/DNS proxy capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.20.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.20.0

    └──▷ USE IT
    Use the new -1 flag to quickly get just the primary IPv4 address for scripting.
    shell copy

    tailscale ip -1

    Enable exit node functionality via CLI using a human-readable node name instead of searching for an IP or ID.
    shell copy

    tailscale up --advertise-exit-node --exit-node=office-pc

    • tailscale status --json now includes an Online boolean field for each node
    • tailscale up --json flag added to enable JSON-formatted output
    • CLI exit node selection now accepts node names instead of requiring IDs
    • Packet filter ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. can now match any IP protocol number via AnyIPProto
    • tailscale file cp in userspace-networking mode now routes through the local tailscaled process

    5 details in Everything

89. v1.18.0 Nov 18, 2021 · release notes

    Tailscale v1.18.0 adds AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. state storage, Prometheus metrics endpoint, and Synology exit node checkbox.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.18.0

    └──▷ TRY IT
    Monitor Tailscale daemon health and connectivity metrics via Prometheus.
    copy

    $ curl http://localhost:8088/debug/metrics

    Store Tailscale state in AWS Systems Manager Parameter Store instead of local disk.
    copy

    $ tailscaled -state arn:aws:ssm:eu-west-1:123456789:parameter/foo

    Force the Linux client to use the legacy /sbin/ip command for IP configuration if network issues occur.
    copy

    $ TS_DEBUG_USE_IP_COMMAND=1 tailscaled

    • Adds TS_DEBUG_USE_IP_COMMAND environment variable to revert IP configuration back to the /sbin/ip command
    • The tailscaled debug server now exports Prometheus metrics at /debug/metrics
    • Support storing Tailscale state using AWS SSM via -state arn:aws:ssm:... flag
    • Adds an exit node enable checkbox in the Synology web login form

    4 details in Everything

90. v1.16.0 Oct 7, 2021 · release notes

    v1.16.0 adds tailscale debug profiling, userspace HTTP proxy, and k8s secret storage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.16.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.16.0

    • Adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiling support via the new tailscale debug command
    • Adds tailscale up --qr flag to display QR codes for authentication
    • Allows tailscale up --authkey=file:/path/to/secret to read auth keys from file URIs
    • Enables userspace-networking mode (tailscaled) to run an HTTP proxy server alongside SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead.

    4 details in Everything

91. v1.14.6 Oct 1, 2021 · release notes

    Adds ISRG Root X1 support and SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy over userspace-tun in Tailscale v1.14.6

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.6 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.14.6

    • Includes LetsEncrypt's ISRG Root X1 as an alternate root to try if the platform roots fail, improving certificate trust chain resilience.
    • Adds SOCKS5 proxy support for tailscale --tun=userspace-networking to dial HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. domain names within the Tailnet.
    • tailscale cert now provides a specific error message when the operation requires root privileges.

    3 details in Everything

92. v1.14.0 Aug 23, 2021 · release notes

    Tailscale v1.14.0 adds PCP response support, local VM/Docker access via exit node, and FreeBSD as exit node.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.14.0

    • Adds Port Control Protocol (PCP) response support to port mapping
    • Allows access to local VMs and Docker Containers while using an exit node
    • Enables FreeBSD to function as an exit node

    3 details in Everything

93. v1.12.0 Jul 27, 2021 · release notes

    Tailscale v1.12.0 adds UPnP support, Azure App Services/container platforms, Windows Server Core CLI mode, MIPS64 binaries, LAN access toggle in UI, and MagicDNS over DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    └──▷ USE IT
    Run Tailscale headlessly on a Windows Server Core machine without interactive login.
    shell copy

    tailscale up --unattended

    • Portmapper now supports UPnP mappings as another way to traverse NAT
    • Adds support for serverless container operation with Azure App Services, AWS App Runner, AWS Lightsail Containers, and other AWS container services built atop AWS Fargate infrastructure.
    • Add a UI toggle to allow LAN access while using an exit node
    • MagicDNS now uses DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. when querying popular upstream resolvers

    4 details in Everything

94. v1.10.0 Jun 24, 2021 · release notes

    Adds tailscale ping --until-direct, TS_DEBUG_MTU env var, macOS LAN access UI, and Taildrop on Android.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    • tailscale ping exits with a non-zero code when --until-direct is used and no direct connection was established
    • Adds TS_DEBUG_MTU environment variable to override the tailscale0 interface MTU size (default for Linux: /etc/default/tailscaled)
    • Allows extra DNS records for LetsEncrypt DNS-01DNS-01An ACME protocol challenge type that proves domain ownership by having the requester publish a specific TXT record in DNS, letting cyber tools obtain TLS certificates for hosts that may not be publicly reachable over HTTP. challenge support
    • Adds macOS UI option to allow local LAN access while using an exit node
    • Adds Taildrop file transfer support on Android

    5 details in Everything

95. v1.8.0 May 6, 2021 · release notes

    v1.8.0 adds SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. support, new CLI subcommands (ip, bugreport, logout), SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy mode, and platform-specific flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    └──▷ TRY IT
    Retrieve the local node's IPv4 Tailscale address for use in shell scripts.
    copy

    $ tailscale ip -4

    Run a layer-independent ping to test connectivity without involving the host IP stack.
    copy

    $ tailscale ping --tsmp 100.64.0.1

    Explicitly start Tailscale in Unattended Mode on Windows.
    copy

    $ tailscale.exe up --unattended

    • tailscale ping --tsmp w.x.y.z sends a layer-independent ping
    • Support for SCTP in port-based ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. (in addition to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.)
    • tailscale bugreport command logs a timestamp for support correlation
    • tailscale logout command
    • tailscale up --unattended flag on Windows to explicitly enable Unattended Mode

    +1 more show less

    • Windows and MacOS systems can serve as subnet routers and exit nodes via CLI

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !On Windows, tailscale up no longer implicitly enables Unattended Mode; you must specify the --unattended flag if that is your intent.
96. v1.6.0 Mar 17, 2021 · release notes

    v1.6.0 adds exit nodes, tunneled IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., port mapping via NAT-PMP, userspace networking mode, SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. server, and a local API to tailscaled

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Exit node support allows routing non-Tailscale internet traffic through another Tailscale node.
    • Tunneled IPv6 enables IPv6 addresses inside the tunnel for nodes supporting it.
    • Port mapping automatically uses NAT-PMP for peer-to-peer connections when router-supported.
    • Userspace networking mode is enabled via --tun=userspace-networking flag, removing root requirement.
    • SOCKS5 server capability added to tailscaled for outbound connections without OS help.

    +1 more show less

    • Local API exposed by tailscaled with initial whois method lookup.

    6 details in Everything

97. v1.4.0 Jan 28, 2021 · release notes

    MagicDNS shared device access, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. in-tunnel support, and tailscale status readability improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ USE IT
    Test userspace networking stack without root privileges on Linux
    shell copy

    tailscaled --tun=userspace-networking --fake

    • Adds MagicDNS support for accessing accepted shared devices by their FQDN
    • Improves tailscale status readability with sorted output, DNS names, owner info, and explicit connection state

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !tailscale up now requires sudo on Linux to change state
98. v1.2.0 Oct 30, 2020 · release notes

    Tailscale v1.2.0 adds MagicDNS, Windows unattended boot, tailscale down/up commands, and new DERP regions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Shut down networking for maintenance without stopping the daemon.
    shell copy

    tailscale down

    Re-authenticate with a different account on Windows.
    shell copy

    tailscale up --force-reauth

    • MagicDNS now runs an embedded DNS server on your machine at 100.100.100.100, serving names for nodes in the network.
    • Windows unattended mode allows the background service to store authentication state, enabling boot without interactive login and multi-user connectivity.
    • New tailscale down command shuts down Tailscale networking without stopping the service.
    • New tailscale up --force-reauth flag initiates the sign-in flow to switch accounts.
    • tailscale status output now prints stars around the active tunnel path to peers and shows local machine information.

    +1 more show less

    • Windows HTTP proxy support via WPAD/PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. autoconfiguration and early Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. authentication.

    6 details in Everything

99. v1.0.3 Aug 8, 2020 · release notes

    CLI availability on Windows/macOS and new tailscale status flags with NAT traversal fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.3 https://github.com/tailscale/tailscale.git
    # already have the repo? check out this version:
    $ git checkout v1.0.3

    └──▷ TRY IT
    Limit tailscale status output to only currently active peer connections.
    copy

    $ tailscale status --active

    Configure DNS acceptance behavior for the tailscaled service on Linux.
    copy

    $ tailscaled --accept-dns

    • Adds --accept-dns flag to tailscaled for Linux configurations
    • Introduces tailscale status --active to filter output to only active peers
    • Enables CLI usage on Windows and macOS platforms alongside existing Linux support

    3 details in Everything

100. v0.99.0 Jun 3, 2020 · release notes

     Tailscale v0.99.0 adds Shields Up mode, netfilter control via --netfilter-mode, SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy support, subnet route JSON output, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.-only compatibility.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.99.0 https://github.com/tailscale/tailscale.git
     # already have the repo? check out this version:
     $ git checkout v0.99.0

     └──▷ TRY IT
     Run tailscale netcheck and get JSON output for monitoring scripts.
     copy

     $ tailscale netcheck --format=json

     Disable source NAT for subnet routes to preserve client IPs on destination machines.
     copy

     $ tailscale up --snat-subnet-routes=false --advertise-routes=192.168.0.0/24

     • --netfilter-mode flag added to tailscale up to control automatic firewall configuration (values: on, nodivert, off)
     • all_proxy environment variable support for SOCKS proxy outbound connections on Linux
     • --snat-subnet-routes=false flag on tailscale up to disable source NAT on subnet route traffic
     • Shields Up mode available via new checkbox in macOS/Windows GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. and as a backend feature
     • --format=json supported by tailscale netcheck for machine-readable output

     +2 more show less

     • --every=DURATION flag added to tailscale netcheck for periodic network probing
     • IPv6-only environment support with connectivity to IPv4 hosts via DERP

     7 details in Everything

101. v0.98 May 5, 2020 · release notes

     Tailscale v0.98 adds tailscale status --json CLI subcommand and supports IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. outbound preference.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.98 https://github.com/tailscale/tailscale.git
     # already have the repo? check out this version:
     $ git checkout v0.98

     └──▷ TRY IT
     Get machine-parseable JSON of the current node's status for scripting or monitoring.
     copy

     $ tailscale status --json

     • Adds the tailscale status --json flag to produce machine-parseable JSON output for the local network engine state on Linux, FreeBSD, and OpenBSD
     • Enables tailscale to prefer IPv6 over IPv4 when sending encrypted packets between nodes

     2 details in Everything