External risk intelligence

Tailscale Android Insecure Permissions Allow Unauthorized Configuration Changes.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107060

This vulnerability affects a specific Android application package. While VPN clients are network-aware, the attack surface described involves modifying local user configurations and preferences within the application environment. It is not a typical internet-facing service, gateway, or public API endpoint that would be exposed to arbitrary unauthenticated remote attackers in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Tailscale's Android application, stemming from insecure permissions. This flaw could permit unauthorized individuals to alter VPN configurations and user preferences without proper authentication, potentially impacting user privacy and network access. The primary concern is to confirm if this specific application version is in use within the organization and if it is exposed to the described risk.

Unauthorized changes to VPN settings.
Confirm if the affected application is in use.
Assess relevance and exposure to the business.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by targeting the Tailscale application on an Android device. The vulnerability allows an unauthenticated attacker to gain unauthorized access and modify another user's VPN settings and preferences without any user interaction. This could lead to significant disruption of network access and potential data exposure.

No authentication or special privileges needed.
Unauthorized access to VPN configurations.
Attacker can change user preferences.

Live Threat

Current exploitation, exposure, and threat context

Insecure permissions in Tailscale could allow unauthorized attackers to modify another user's VPN configurations and preferences. This could occur when the application's permissions are not properly restricted, potentially impacting the security and integrity of user VPN connections.

VPN configurations and preferences.
Unauthorized modification of settings.
Compromised VPN tunnel security.

Operational Fix

Recommended remediation, mitigation, and detection steps

Insecure permissions in this VPN client allow any attacker to alter another user's settings. Your first step is to identify all instances of this application, determine their business criticality and network exposure, and then assign ownership for remediation.

App owners should manage this issue.
Verify application instances and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tailscale and how is it used?

Tailscale is a zero-configuration VPN service built on the WireGuard protocol. It enables devices to create private, encrypted mesh networks, allowing users to securely access resources across different locations as if they were on the same local network. This specific issue involves the Tailscale Android application (version 297862600), which manages these secure tunnels and user connection preferences on mobile devices.

What does CVE-2026-107060 mean by insecure permissions?

This vulnerability is classified as CWE-732, which refers to incorrect permission assignment for critical resources. Essentially, the Android application does not properly restrict access to its configuration files. Because the app fails to enforce strict access controls, an unauthorized party can bypass intended protections to manipulate the VPN settings and user preferences stored within the application's local environment.

How can an attacker trigger this vulnerability?

An attacker can modify configuration settings without needing authentication or special user privileges on the device. It is important to note that this bug does not grant the attacker direct control over the underlying Android operating system or physical device hardware; the scope of the impact is strictly limited to the Tailscale application's internal VPN settings and user-defined preferences.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal labels this risk as 'Unlikely' because the vulnerability impacts a specific Android app package rather than a public-facing gateway or network service. Since the attack surface is localized to the application's configuration environment, it is not a typical internet-exposed API endpoint, significantly reducing the probability of remote exploitation in standard organizational deployments.

What steps should I take if I use this application?

Start by identifying all devices within your environment currently running the affected version of the Tailscale Android application. Once identified, evaluate the criticality of the data accessed by those devices and assign owners to oversee the security of these endpoints. Ensure you monitor vendor communications for official updates to the application to resolve these permission restrictions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.