---
title: If you run Tailscale SSH or serve, move every node to 1.104.4+ and re-check SSH forwarding grants | ctxsec
url: https://ctxsec.com/items/tip-upgrade-tailscale-to-1-104-4
description: ""
status: "guidance"
published: 2026-10-28
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-upgrade-tailscale-to-1-104-4.md)

guidance

2026-10-28

### If you run Tailscale SSH or serve, move every node to 1.104.4+ and re-check SSH forwarding grants

After the [Tailworm](/items/tailworm-tailscale-ssh-headscale-11-findings) findings and Tailscale's TS-2026-014–017 bulletins:

1. Roll **1.104.4 or newer** to every Linux (and open-source macOS) node that runs Tailscale SSH or `tailscale serve`.
2. In the ACL/policy file, list SSH rules: prefer explicit source→destination grants; turn off forwarding on rules that do not need it.
3. Remove Docker socket and other root Unix sockets from anything a forwarded session could have reached before the patch; rotate credentials that lived on those hosts if you had broad SSH tags.

Sources: [Tailscale security bulletins TS-2026-014 through TS-2026-017](https://tailscale.com/security-bulletins) · [Tailscale v1.104.4 release](https://github.com/tailscale/tailscale/releases/tag/v1.104.4)