Tailscale Release Notes

A new release of the Tailscale Kubernetes Operator is available. For guidance on installing and updating, refer to our installation instructions.

New

PeerRelays are deployable in-cluster via a custom resource.

Annotations can now be applied to the operator's deployment resource via Helm.

Workload identity federation can now be configured for the Tailnet custom resource.

4via6 is supported in connector and egress proxy resources when egressing from a dual-stack cluster.

IPv6 is supported in Egress ProxyGroups.

Changed

Operator log output excludes superfluous entries, such as entries for resources that do not contain annotations.

Several log lines have adjusted log levels.

Fixed

MTU values are clamped on both the input and output interfaces, where previously only the output interface was clamped.

ProxyGroup services no longer fail to reconcile when using the same hostname across multiple tailnets.

ProxyGroup static endpoints no longer cause constant reconciliation loops due to non-deterministic ordering.

DNS reconciler no longer drops reconcile events, which left the dnsrecords ConfigMap stale.

EndpointSlices for Egress ProxyGroup are verified on every reconcile.

Cert renewal retries follow Let's Encrypt's recommended backoff schedule instead of a fixed interval.

Let's Encrypt Retry-After headers are honored by Kubernetes proxies when hitting rate limits, which avoids the tight retry loops that made rate-limit backoffs worse.

Per-attempt cert issuance timeout in Kubernetes proxies is increased to 30 minutes, giving ACME challenges room to complete under load without failing prematurely.

Cert issuance attempts no longer run against a VIPService that is being torn down during Ingress deletion, which wasted Let's Encrypt rate-limit quota.

All Platforms

New: tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services.

New: The tailscale get CLI command returns the current node's preferences.

New: The tailscale whoami CLI command displays information about the current user and device.

New: The tailscale service list CLI command displays Tailscale Services visible to the current node.

Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets.

Changed: Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals.

Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use.

Changed: TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate.

Fixed: Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode.

Fixed: Certificate issuance for multiple domains runs in parallel. Provisioning multiple domains does not stall each certificate behind the previous one.

Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go.

Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node.

Fixed: A memory leak that occurred after a failed WireGuard handshake has been resolved.

Fixed: tailscale status --peers=false command shows the current device name in the output.

Fixed: Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.

Fixed: Tailscale SSH passes environment variables to child processes via inherited file descriptors. This fix addresses a security vulnerability described in TS-2026-010.

Linux

New: Assembly crypto routines for 32-bit ARM are available, improving performance on these platforms.

Changed: Userspace TUN optimizations improve throughput and performance.

Fixed: Resolved an issue impacting performance of UDP GSO on Linux v7.0.x through v7.1.4.

macOS

New: The Tailscale protocol handler supports deep-linking to devices, exit nodes, and settings panels in the application window.

Changed: The device list in the menu bar and Windowed UI loads more efficiently.

Changed: The client onboarding process is redesigned to match the style of the windowed UI.

Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.

Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.

Fixed: Domain matching on-demand rules are evaluated in the correct order.

Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.

Fixed: tailscale configure kubeconfig checks permissions on the $KUBECONFIG file before refusing to write to it when it's in a non-standard directory, fixing false rejections during Kubernetes API server access setup.

iOS

New: A new split-plane layout is used on iPad in both portrait and landscape orientation and on sufficiently wide iPhones in landscape.

New: The status widget supports toggling the active exit node inline.

Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.

Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.

Fixed: Domain matching on-demand rules are evaluated in the correct order.

Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.

tvOS

New: The Tailscale web client is supported for remote management of Apple TV devices.

Changed: The client onboarding process ensures the VPN configuration is approved and a login profile is added before using fast user switching.

Fixed: tvOS does not require a restart to use a custom coordination server defined in Settings.

Android

Changed: A single CGNAT route is created when no other interface is using CGNAT.

Fixed: TCP connections do not reset when VPN routing changes due to a netmap update.

Fixed: Health warnings are promptly cleared as soon as the underlying issue is resolved.

Synology

Changed: RMv7 binaries with software floating point are produced for certain Synology NAS models, replacing older ARMv5 binaries.

All Platforms

• Fixed: Tailscale Serve Unix socket proxy targets are restricted to the root user. This fix addresses a security vulnerability described in TS-2026-005.
• Fixed: Tailscale SSH does not allow the use of UIDs or numeric-only usernames. This fix addresses a security vulnerability described in TS-2026-006.
• Fixed: Nodes advertising Tailscale Services filter and reject packets from service IPs on ports they do not advertise. This fix addresses a security vulnerability described in TS-2026-007.
• Fixed: Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. This fix addresses a security vulnerability described in TS-2026-008.
• Fixed: Tailscale SSH does not allow the use of usernames with leading dashes. This fix addresses a security vulnerability described in TS-2026-009.
• Fixed: An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved.
• Fixed: An issue that could cause a crash on 32-bit ARM platforms is resolved.