Unpatched Tailscale SSH Flaws Allow Compromised Device to Gain Root on Other Servers

Background

A security researcher named Erica Windisch published a report called Tailworm on October 25, 2026, describing unpatched flaws in Tailscale SSH. The tested versions were Tailscale 1.104.2 and headscale 0.29.5. As of the publication date Tailscale had not issued a security bulletin, a CVE identifier, or a fixed release.

Mike Shaver, Tailscale's vice president of engineering, confirmed that the company received the report and is working with external specialists to address the issues. He said the company was still working out which setups are affected and that it does not recommend that everyone disable Tailscale SSH.

Technical Details

The attack requires a foothold on one device that the network's access rules allow to connect to a target. With SSH port forwarding enabled the root-level Tailscale process can be forced to connect to a privileged system socket, giving the attacker root access and the ability to read the password file. A second technique replaces a root-owned socket with the attacker's socket, enabling direct root command execution. A third method races a file-path check to bypass a safety limit, and in the lab this chain captured an enrollment key and joined an attacker-controlled machine to the network when Tailnet Lock was not enabled.

On Tailscale's hosted service forwarding can be turned off per rule, but on headscale 0.29.5 forwarding cannot be disabled, so every SSH grant there should be treated as granting root on the target. The researcher described the spread as wormable because one compromised device could reach every allowed device in under a second per step.

Mitigation Steps

Administrators should rewrite SSH access rules as single source-to-destination pairs that name one device and one target, and remove broad rules based on identity or tag. Port forwarding should be disabled wherever possible; on the hosted service this is a per-rule setting, while on headscale it cannot be turned off. App connector permissions and any tailscale serve forward that points at a Unix socket should be removed. Enabling node-key expiry, deleting compromised devices at the control plane, turning on SSH check mode, and enabling automatic updates are additional recommended measures.

Sources: The Hacker News