CVE-2026-57999

Name of the Vulnerable Software and Affected Versions luci-app-tailscale-community (affected versions not specified)

Description An issue in the tailscale.do login RPC method allows authenticated users to execute arbitrary commands with root privileges. This occurs because the loginserver and loginserver authkey parameters are improperly quoted within a double-quoted shell command, enabling shell substitutions such as $() to be evaluated by the outer shell before argument processing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.