Tailscale bug allowed a person to share nodes from other tailnets without auth
Bug reporter here: fwiw I just want to credit Tailscale for how they handled the disclosure and remediation.Deploying a prod fix within 24 hours is pretty great, they’ve been super cooperative and pleasant to deal with and (as far as I could ascertain) there was no apparent way to get the database IDs for nodes you didn’t have pre-knowledge of