headscale v0.29.7 released on 30-10-2026
headscale v0.29.7 is out now. It is a security-focused patch addressing findings from Anthropic’s oss-scanner and the Tailworm report, and requires a matching Tailscale client upgrade to obtain fixes for SSH forwarding, SSH session handling and Serve vulnerabilities.
See the project GitHub, the headscale upgrade guide (https://headscale.net/stable/setup/upgrade/) and Tailscale’s security bulletins for full instructions and the changelog.
What’s in this release
- Security fixes and an update of the Tailscale dependency to v1.104.4; Tailscale clients should be upgraded to v1.104.4+ to receive SSH and Serve fixes.
- Noise protocol and network hardening: metrics no longer exposed to unregistered clients, and stalled request bodies and idle Noise tunnels time out after 30 seconds.
- Limits and caps on pending registrations, OIDC flows and client reports: pending interactive registration data is capped at 64 KiB, OIDC callbacks are accepted only once, and client-reported endpoints/routes are bounded.
Upgrade notes
- Upgrade Headscale to v0.29.7 and upgrade Tailscale clients to v1.104.4 or newer — upgrading Headscale alone does not apply fixes that run in tailscaled. For Tailscale SSH users, consider setting TS_SSH_DISABLE_FORWARDING=1 in tailscaled’s environment and restart the service to disable SSH agent and port forwarding until clients are upgraded.
- Minimum supported Tailscale client remains v1.80.0; follow the headscale upgrade guide for step-by-step instructions and the changelog for details.
Share any comments on your upgrade experience or issues encountered so the community can learn from practical results.
