---
id: "CVE-2026-107060"
kind: "vulnerability"
aliases: ["CVE-2026-107060"]
title: "Tailscale Android: insecure permissions let attackers change other users' VPN settings"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "other", "tailscale"]
not_affected_if: []
published_at: "2026-10-29T17:17:58+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:27:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107060", "first_seen_at": "2026-10-29T17:26:17+00:00"}]
---

# Tailscale Android: insecure permissions let attackers change other users' VPN settings

Tailscale versionCode 297862600 has insecure permissions that let an unauthorized attacker change another user's VPN configuration and preferences. The sources do not describe how the attacker reaches the device or whether an account is needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107060

## From the sources

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_