“In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.”
Tailscale SSH exists to enforce who gets which access. Most of the bugs let a connected user step past their local permissions, up to elevated privileges. The patch is due by end of day, pending tests. Until then the advice is to tighten the access policies you were paying Tailscale to enforce.