Leveraging Tailscale Keys

This post is a red-team oriented walkthrough on identifying and abusing Tailscale authentication artifacts (Trusted Keys and auth keys) found in CI/CD or code repositories to programmatically join a target Tailnet. It covers key formats and how to exchange Trusted Keys for API tokens, creating auth keys (ephemeral, reusable, preauthorized), using tags and access controls, joining nodes with tailored tags, enumerating Tailnet state (e.g., tailscale status --json), and abusing subnet routers, exit nodes, and Tailscale SSH to access internal networks, proxy traffic, and achieve passwordless lateral movement; it also highlights defensive indicators such as admin console alerts and the value of protecting access control policies.