How do I check whether I am affected by TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d?

- Check whether Tailscale SSH is on: run tailscale status / tailscale debug prefs (RunSSH), or look at the admin console for nodes with SSH enabled and for ssh rules in the tailnet policy file. - Check the client version: tailscale version <= 1.104.2 is affected. For headscale, <= 0.29.6 is affected. - Look for broad SSH rules (identity-wide or tag-wide accept rules) and for rules that allow forwarding. - Check for app connectors (conn25) in use, for tailscale serve forwards that point at Unix sockets, and for headscale reachable from the internet. - Hunting: Unix sockets created under /tmp, /run/user or home directories by tailscaled during SSH sessions. Unexpected new tagged nodes or auto-approved routes in the tailnet. Indicators of compromise: unknown.

Live › technique › TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d

Go to dashboard

high⚡ Early warning · no CVE yetTailwormInfrastructure

Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Q: What is the fix for TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d?

- Update the Tailscale client as soon as the patched release ships (Tailscale is aiming for 2026-10-27). For headscale, watch for a release that includes PR #3586. - Until then, run tailscale set --ssh=false on nodes that do not need Tailscale SSH. Make sure you have another way in first. - Replace identity-wide and tag-wide SSH rules with grants that name one source and one target, and set forwarding to false in each SSH rule. - On headscale 0.29.5, forwarding cannot be turned off, so treat every SSH grant as root-equivalent. - Remove unused app connector permissions and serve forwards to Unix sockets. Turn on node-key expiry and Tailnet Lock. - If a node is compromised, delete it at the control plane. Reimaging the host alone is not enough.

Tailworm, a report published 2026-10-25 by Erica Windisch of Cyberdione Labs, lists 11 issues found in lab tests of Tailscale 1.104.2 and headscale 0.29.5. The worst ones are in Tailscale SSH, which runs inside the root tailscaled daemon. It forwards Unix sockets (ssh -L/-R) as root, and a race gets around its path allowlist. So an unprivileged session from any device the SSH policy allows can reach privileged sockets such as docker.sock, become root, steal enrollment keys, and spread to other devices the policy allows. Other findings: app connectors (conn25) that ignore ACLs and can reach cloud metadata and Kubernetes services, unauthenticated memory exhaustion and onboarding lockout in headscale, an unbounded read in the DERP client, and serve --tcp exposing the localapi socket. Teams at risk run Tailscale SSH with forwarding allowed, app connectors, or a self-hosted headscale reachable from the internet. Tailscale confirmed the issues are real and serious, mostly privilege escalation. Fixes are merged on main, and Tailscale aims to ship a patched client by the end of 2026-10-27. As of 2026-10-27 there is no CVE and no numbered fixed release. No attacks in the wild have been reported.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: primary source, exploitation

First public: Oct 25, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 06:32 UTC. All times on this page are UTC.

Who is affected

2 products

Product	Ecosystem	Affected	Fixed in
Tailscale	vendor	<= 1.104.2	–
headscale	vendor	<= 0.29.6	–

Who cares: early-warning, headscale, privilege-escalation, ssh, tailscale, technique
Not affected if: –

How to check

Check whether Tailscale SSH is on: run tailscale status / tailscale debug prefs (RunSSH), or look at the admin console for nodes with SSH enabled and for ssh rules in the tailnet policy file.
Check the client version: tailscale version <= 1.104.2 is affected. For headscale, <= 0.29.6 is affected.
Look for broad SSH rules (identity-wide or tag-wide accept rules) and for rules that allow forwarding.
Check for app connectors (conn25) in use, for tailscale serve forwards that point at Unix sockets, and for headscale reachable from the internet.
Hunting: Unix sockets created under /tmp, /run/user or home directories by tailscaled during SSH sessions. Unexpected new tagged nodes or auto-approved routes in the tailnet. Indicators of compromise: unknown.

Know the next one before it finds you.

Add to Slack

Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Tailscale

vendor

<= 1.104.2

–

headscale

vendor

<= 0.29.6

–

Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Who is affected

How to check

Know the next one before it finds you.

Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

What people are saying

Sources