Great writeup on Tailscale DNS rebinding vulns (patch now) chaining 5 of 7 issues together for RCE. "To learn the target's username, we must first learn their password." :)
https://emily.id.au/tailscale
by
https://hachyderm.io/@emilyposting/109383131508802209