Vulnerabilities & Exploits
Tailscale SSH flaw lets authorized devices reach root Cyberdione Labs researcher Erica Windisch reported Oct. 25 that Tailscale SSH port forwarding could let an attacker controlling one policy-authorized device gain root access on reachable servers. Her tests used Tailscale 1.104.2 and headscale 0.29.5 in a lab, not real networks.
Tailscale SSH checks whether a device is allowed to connect rather than asking for a password or key. With forwarding enabled, an ordinary SSH session can make Tailscale’s root-running process access a system socket reserved for root, turning permitted connectivity into root access. The attacker must already control an authorized device; this is a lateral-movement risk, not an initial way into the network.
For self-hosted networks on headscale 0.29.5 , forwarding cannot be disabled, so an already-compromised device may gain root on servers its SSH grants can reach. Windisch’s lab findings do not establish attacks on live networks; Tailscale had announced no fixed version at publication.
4 sources · 4h ago
Timeline Sources Oct 28 Help Net Security
Tailscale fixes SSH flaws allowing lateral movement within tailnets - Help Net Security
Tailscale patches Tailworm SSH flaws that let a compromised device gain root on other tailnet machines, but disputes the "worm" label.
original Oct 28 The Hacker News
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale 1.104.4 fixes SSH forwarding flaws that could expose root-only sockets, while related issues remain unpatched in headscale.
original Oct 27 SecurityWeek
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.
original Part of the PlainSec briefing for 2026-10-28
Every edition of this story: Tailscale SSH flaw lets authorized devices reach root
More from today Vulnerabilities & Exploits
Tailscale SSH flaw lets authorized devices reach root Cyberdione Labs researcher Erica Windisch reported Oct. 25 that Tailscale SSH port forwarding could let an attacker controlling one policy-authorized device gain root access on reachable servers. Her tests used Tailscale 1.104.2 and headscale 0.29.5 in a lab, not real networks.
Tailscale SSH checks whether a device is allowed to connect rather than asking for a password or key. With forwarding enabled, an ordinary SSH session can make Tailscale’s root-running process access a system socket reserved for root, turning permitted connectivity into root access. The attacker must already control an authorized device; this is a lateral-movement risk, not an initial way into the network.
For self-hosted networks on headscale 0.29.5 , forwarding cannot be disabled, so an already-compromised device may gain root on servers its SSH grants can reach. Windisch’s lab findings do not establish attacks on live networks; Tailscale had announced no fixed version at publication.
4 sources · 4h ago
Timeline Sources Oct 28 Help Net Security
Tailscale fixes SSH flaws allowing lateral movement within tailnets - Help Net Security
Tailscale patches Tailworm SSH flaws that let a compromised device gain root on other tailnet machines, but disputes the "worm" label.
original Oct 28 The Hacker News
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale 1.104.4 fixes SSH forwarding flaws that could expose root-only sockets, while related issues remain unpatched in headscale.
original Oct 27 SecurityWeek
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.
original Part of the PlainSec briefing for 2026-10-28
Every edition of this story: Tailscale SSH flaw lets authorized devices reach root
More from today