{
  "created_at": "2026-07-07T22:09:00Z",
  "parent_root_cause": "Missing auth on /api/tunnel/tailscale-install plus sudoPassword written to stdin of sudo -S sh so no-prompt sudo lets sh interpret password bytes as commands.",
  "candidate_root_cause_comparison": [
    {
      "candidate_id": "c1_install_trailing_slash",
      "same_root_cause": false,
      "reason": "Redirects to canonical route; no independent trigger."
    },
    {
      "candidate_id": "c2_start_daemon",
      "same_root_cause": false,
      "reason": "Uses sudoPassword for sudo -S tailscaled and does not feed password bytes to a shell script stdin."
    },
    {
      "candidate_id": "c3_cli_tools_mitm",
      "same_root_cause": false,
      "reason": "Already behind auth in vulnerable build and does not expose the same unauthenticated tunnel matcher gap."
    }
  ],
  "overall_same_root_cause_variant_confirmed": false
}