{"id":"TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d","kind":"technique","aliases":[],"related":[],"title":"Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet","description":null,"summary":"Tailworm, a report published 2026-10-25 by Erica Windisch of Cyberdione Labs, lists 11 issues found in lab tests of Tailscale 1.104.2 and headscale 0.29.5. The worst ones are in Tailscale SSH, which runs inside the root tailscaled daemon. It forwards Unix sockets (ssh -L/-R) as root, and a race gets around its path allowlist. So an unprivileged session from any device the SSH policy allows can reach privileged sockets such as docker.sock, become root, steal enrollment keys, and spread to other devices the policy allows. Other findings: app connectors (conn25) that ignore ACLs and can reach cloud metadata and Kubernetes services, unauthenticated memory exhaustion and onboarding lockout in headscale, an unbounded read in the DERP client, and serve --tcp exposing the localapi socket. Teams at risk run Tailscale SSH with forwarding allowed, app connectors, or a self-hosted headscale reachable from the internet. Tailscale confirmed the issues are real and serious, mostly privilege escalation. Fixes are merged on main, and Tailscale aims to ship a patched client by the end of 2026-10-27. As of 2026-10-27 there is no CVE and no numbered fixed release. No attacks in the wild have been reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tailscale","fixed":[],"affected":"<= 1.104.2","ecosystem":"vendor"},{"name":"headscale","fixed":[],"affected":"<= 0.29.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","headscale","privilege-escalation","ssh","tailscale","technique"],"not_affected_if":[],"how_to_check":"- Check whether Tailscale SSH is on: run tailscale status / tailscale debug prefs (RunSSH), or look at the admin console for nodes with SSH enabled and for ssh rules in the tailnet policy file.\n- Check the client version: tailscale version <= 1.104.2 is affected. For headscale, <= 0.29.6 is affected.\n- Look for broad SSH rules (identity-wide or tag-wide accept rules) and for rules that allow forwarding.\n- Check for app connectors (conn25) in use, for tailscale serve forwards that point at Unix sockets, and for headscale reachable from the internet.\n- Hunting: Unix sockets created under /tmp, /run/user or home directories by tailscaled during SSH sessions. Unexpected new tagged nodes or auto-approved routes in the tailnet. Indicators of compromise: unknown.","fix":"- Update the Tailscale client as soon as the patched release ships (Tailscale is aiming for 2026-10-27). For headscale, watch for a release that includes PR #3586.\n- Until then, run tailscale set --ssh=false on nodes that do not need Tailscale SSH. Make sure you have another way in first.\n- Replace identity-wide and tag-wide SSH rules with grants that name one source and one target, and set forwarding to false in each SSH rule.\n- On headscale 0.29.5, forwarding cannot be turned off, so treat every SSH grant as root-equivalent.\n- Remove unused app connector permissions and serve forwards to Unix sockets. Turn on node-key expiry and Tailnet Lock.\n- If a node is compromised, delete it at the control plane. Reimaging the host alone is not enough.","status":"open","published_at":"2026-10-25T00:00:00+00:00","first_seen_at":"2026-10-27T06:32:16+00:00","triaged_at":"2026-10-27T06:32:16+00:00","updated_at":"2026-10-27T06:32:16+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':48B,219B,224B '-202610':19A '-25':49B '-27':220B,225B '0.29.5':68B '1.104.2':65B '11':57B '2026':47B,218B,223B 'acl':138B 'aim':208B 'allow':110B,130B,177B 'allowlist':99B 'app':133B,178B 'around':96B 'attack':236B 'becom':118B 'client':161B,213B 'cloud':142B 'compromis':8A 'compromised':28A 'confirm':191B 'conn25':135B 'connector':134B,179B 'cve':229B 'cyberdion':54B 'd':29A 'daemon':82B 'derp':160B 'devic':9A,106B,127B 'docker.sock':117B 'earli':34B 'early-warn':33B 'end':216B 'enrol':121B 'erica':51B 'escal':39B,200B 'exhaust':149B 'expos':165B 'find':132B 'fix':201B,233B 'flaw':4A 'flaws':24A 'forward':84B,176B 'found':59B 'get':10A,95B 'headscal':36B,67B,154B,185B 'headscale':32A 'host':184B 'ignor':137B 'insid':78B 'internet':189B 'issu':58B,193B 'key':122B 'kubernet':145B 'l':88B 'lab':55B,61B 'let':6A,26A 'list':56B 'localapi':167B 'lockout':152B 'main':205B 'memori':148B 'merg':203B 'metadata':143B 'most':198B 'number':232B 'onboard':151B 'one':7A,27A,71B 'patch':212B 'path':98B 'polici':109B,129B 'privileg':38B,113B,199B 'privilege-escal':37B 'publish':46B 'r':89B 'race':94B 'reach':112B,141B 'reachabl':186B 'read':157B 'real':195B 'releas':234B 'report':45B,242B 'risk':171B 'root':11A,80B,91B,119B 'run':77B,172B 'self':183B 'self-host':182B 'serious':197B 'serv':163B 'server':14A 'servic':146B 'session':103B 'ship':210B 'socket':86B,114B,168B 'spread':124B 'ssh':3A,23A,40B,75B,87B,108B,174B 'steal':120B 'tailnet':17A 'tailscal':2A,41B,64B,74B,81B,173B,190B,207B 'tailscale':22A,31A 'tailworm':5A,25A,30A,43B 'tcp':164B 'team':169B 'tech':18A 'techniqu':42B 'test':62B 'unauthent':147B 'unbound':156B 'unix':85B 'unpatch':1A 'unpatched':21A 'unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d':20A 'unprivileg':102B 'warn':35B 'wild':239B 'windisch':52B 'worst':70B","nicknames":["Tailworm"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d","url":null,"severity":null,"published_at":"2026-10-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-27T06:32:16+00:00","fetched_at":"2026-10-27T06:32:16+00:00","note":null}],"documents":[{"id":5324,"url":"https://x.com/TheHackersNews/status/2114961487999750239","title":"@TheHackersNews: ‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real.\n\nIts new investi","kind":"post","source":"x","text":"‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real.\n\nIts new investigation page says most of what it found is privilege escalation and calls the issues “serious.” Fix targeted within 24 hours — no CVE or patched version out yet.\n\nMitigate now:\n→ Set https://t.co/hGOawLtQlH\n\nlikes 1 reposts 0","published_at":"2026-10-27T06:04:47+00:00","relation":"describes","confidence":null,"note":null},{"id":5381,"url":"https://tailworm.com/","title":"Tailworm: Security Assessment Report — Tailscale v1.104.2 and headscale v0.29.5 (Cyberdione Labs)","kind":"blog","source":"analyst","text":"Erica Windisch (Cyberdione Labs) report, 11 findings, lab-tested 2026-10-22..24 on tailscale v1.104.2 and headscale v0.29.5. Tailscale SSH (embedded in root tailscaled) performs unix-socket forwarding (ssh -L/-R) path checks and dial/bind/unlink as root; TOCTOU race defeats path allowlist (home, /tmp, /run/user). An ordinary session on a policy-permitted device can reach privileged sockets (docker.sock, init system) -> root, capture enrollment keys, delete root files; wormable across policy-permitted devices. Other: conn25 app connectors bypass ACLs (cloud metadata, k8s services); headscale unauthenticated memory exhaustion / registration cache eviction; DERP client unbounded read; serve --tcp to localapi socket; per-mount capability bleed. Update 2026-10-27: fixes landed on main (tailscale PRs #21941-#21944, #21959, #21963, #21945, #21953, #21966, #21931, #21980; headscale PR #3586 pending), no numbered release yet; Tailscale targeting patched client by end of 2026-10-27. Affected: tailscale <= v1.104.2, headscale <= v0.29.6. Mitigations: per-pair SSH grants; disable SSH forwarding per rule (not possible on headscale 0.29.5: treat SSH grants as root-equivalent); tailscale set --ssh=false where not needed; restrict app connector entitlements; remove serve forwards to unix sockets; node-key expiry; Tailnet Lock; delete compromised nodes at control plane.","published_at":"2026-10-25T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":5382,"url":"https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html","title":"Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers","kind":"blog","source":"analyst","text":null,"published_at":"2026-10-25T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":3037,"url":"https://news.ycombinator.com/item?id=50227138","title":"Tailworm – Tailscale Vulnerabilities","kind":"post","source":"hackernews","text":"Tailworm – Tailscale Vulnerabilities\nhttps://tailworm.com/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-25T00:59:48+00:00","relation":"discussion","confidence":null,"note":null},{"id":3702,"url":"https://x.com/sans_isc/status/2114560289186476291","title":"@sans_isc: SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.j","kind":"post","source":"x","text":"SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale \"Tailworm\" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws\n https://t.co/d3mm2mQjQA https://t.co/3WeoaqVWre\n\nlikes 0 reposts 0","published_at":"2026-10-26T03:30:34+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":3794,"url":"https://x.com/TheHackersNews/status/2114672008097378648","title":"@TheHackersNews: ‼️ Tailscale SSH (Tailworm)\n\nResearchers report that a compromised, SSH-authoriz","kind":"post","source":"x","text":"‼️ Tailscale SSH (Tailworm)\n\nResearchers report that a compromised, SSH-authorized device could gain root on permitted targets via forwarding flaws.\n\nNot unauthenticated RCE. Lab-tested; scope still under review.\n\nMitigations:\n• Tighten SSH access policies\n• Disable forwarding https://t.co/0KIPHlxN7c\n\nlikes 10 reposts 3","published_at":"2026-10-26T10:54:30+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}