NVIDIA Sync bundles an outdated Tailscale version (v1.92.5) in 0.100.19-18

Accelerated Computing DGX Spark / GB10 User Forum DGX Spark / GB10
1

NVIDIA Sync bundles an outdated Tailscale version (v1.92.5) in 0.100.19-18

Hi NVIDIA team,

While troubleshooting NVIDIA Sync’s Tailscale integration on macOS (Apple Silicon), I inspected the bundled nvsync-arm64 binary and found that the application embeds Tailscale v1.92.5.

Environment

  • Product: NVIDIA Sync
  • Version: 0.100.19-18
  • Platform: macOS (Apple Silicon)
  • Build Date: Tue Jul 28 13:08:22 PDT 2026

Evidence

Using Go’s build information:

go version -m "/Applications/NVIDIA Sync.app/Contents/Resources/bin/nvsync-arm64" | grep -Ei 'tailscale|wireguard|version'

Output:

dep tailscale.com v1.92.5
dep github.com/tailscale/wireguard-go ...
build CLIVersion=0.100.19-17-1-g5600b90
BuildTime=Tue Jul 28 13:08:22 PDT 2026

The binary also clearly embeds the complete Tailscale networking stack:

  • tsnet
  • wireguard-go
  • LocalAPI
  • DERP
  • Magicsock
  • Tailscale Services
  • Embedded Tailscale Web Client

This confirms that NVIDIA Sync does not use the system-installed Tailscale client, but instead statically links its own copy of the Tailscale engine.

Security implications

The embedded version is:
Component
Version
Embedded Tailscale
1.92.5
Current Stable
1.102.2

This means NVIDIA Sync is currently five release trains behind the latest stable release.

According to Tailscale’s official Security Bulletins, the following security issues were fixed after 1.92.5:
Advisory
Severity
Affected Feature
Summary
TS-2026-005
High
Tailscale Serve
Non-root operators could proxy privileged Unix sockets (for example Docker or containerd sockets) through tailscaled, potentially bypassing filesystem permissions. Fixed in 1.98.9.
TS-2026-006
Critical
Tailscale SSH
Users could authenticate as UID 0 (root) using a numeric username, bypassing autogroup:nonroot ACL restrictions. Fixed in 1.98.9.
TS-2026-007
High
Tailscale Services
Services accepted traffic on non-advertised ports, allowing access to loopback-only services on the host. Fixed in 1.98.9.
TS-2026-008
Medium
Serve / Funnel
A malformed HTTP request could permanently consume one CPU core (DoS). Fixed in 1.98.9.
TS-2026-009
Critical
Tailscale SSH
A username beginning with - (for example -i) could be interpreted as a command-line option, allowing a user with SSH access to obtain an interactive root session, bypassing ACL restrictions. Fixed in 1.98.9.

In addition to these published security bulletins, the releases between 1.92.5 and 1.102.2 include numerous networking, stability, protocol compatibility, and performance improvements affecting DERP, Magicsock, WireGuard integration, relay handling, and client reliability. Tailscale also recommends keeping clients updated in a timely manner because security fixes are delivered through regular releases.

Although NVIDIA Sync may not expose every Tailscale feature (such as SSH, Serve, Funnel or Services), embedding an older networking stack means users cannot benefit from upstream security fixes, protocol improvements, bug fixes, and performance enhancements until NVIDIA republishes NVIDIA Sync.

Updating the standalone Tailscale client on macOS has no effect, since NVIDIA Sync uses its own statically linked tsnet implementation.

Request

Would it be possible to:

  1. Update the embedded dependency to the latest stable Tailscale release.
  2. Keep the embedded Tailscale version synchronized with upstream stable releases.
  3. Expose the embedded Tailscale version in the UI or CLI for easier troubleshooting.
  4. (Optional) Allow NVIDIA Sync to use the system-installed Tailscale daemon where supported, instead of an embedded tsnet implementation.

Why this matters

NVIDIA Sync is an excellent tool for DGX Spark users, and keeping its embedded networking stack aligned with upstream Tailscale releases would:

  • Reduce exposure to publicly disclosed security issues.
  • Improve networking reliability.
  • Improve compatibility with newer Tailnet features.
  • Reduce troubleshooting complexity.
  • Allow administrators to remain compliant with internal security policies requiring current software versions.

Thank you for building an excellent product. I hope this report helps improve the long-term security and maintainability of NVIDIA Sync.

2

image
image2888×410 102 KB

Even the Tailscale Console is urging people to update.

4

Thank you for the detailed report and for calling out the embedded Tailscale version and the associated advisories.

Please allow us some time to connect with the NVIDIA Sync team for internal review, since the Tailscale path is handled through Sync’s built-in integration. We agree this should be reviewed as a security-sensitive issue. Your feedback on updating the bundled dependency, keeping it closer to upstream, exposing the version in the UI, and evaluating a system-managed Tailscale option is noted.

I’ll update this topic once we have more information to share.

5

Thanks Neill! Appreciated the reply.

7

Hi @pducharme ,

I have an update on your inquiry from the NVIDIA Sync engineering team; I can confirm that the next release will include an updated version of Tailscale.

Further, we will be keeping tailscale dependency up to date with all subsequent releases moving forward. Additionally, your other suggestions such as allowing further flexibility re: Tailscale daemon management are on our roadmap.

I can’t confirm timelines for the release or subsequent roadmap; these will be announced through our docs site when available.

Thanks,
Neill

8

Wow ! thank you for such a quick turnaround. Any spare DGX Spark or RTX Spark to share ? :D (I wishhhh)