---
id: "TECH-202610-unpatched-tailscale-ssh-flaws-tailworm-let-one-compromised-d"
kind: "technique"
aliases: []
title: "Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Tailscale", "fixed": [], "affected": "<= 1.104.2", "ecosystem": "vendor"}, {"name": "headscale", "fixed": [], "affected": "<= 0.29.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["early-warning", "headscale", "privilege-escalation", "ssh", "tailscale", "technique"]
not_affected_if: []
published_at: "2026-10-25T00:00:00+00:00"
first_seen_at: "2026-10-27T06:32:16+00:00"
updated_at: "2026-10-27T06:32:16+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T06:32:16+00:00"}]
---

# Unpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailworm, a report published 2026-10-25 by Erica Windisch of Cyberdione Labs, lists 11 issues found in lab tests of Tailscale 1.104.2 and headscale 0.29.5. The worst ones are in Tailscale SSH, which runs inside the root tailscaled daemon. It forwards Unix sockets (ssh -L/-R) as root, and a race gets around its path allowlist. So an unprivileged session from any device the SSH policy allows can reach privileged sockets such as docker.sock, become root, steal enrollment keys, and spread to other devices the policy allows. Other findings: app connectors (conn25) that ignore ACLs and can reach cloud metadata and Kubernetes services, unauthenticated memory exhaustion and onboarding lockout in headscale, an unbounded read in the DERP client, and serve --tcp exposing the localapi socket. Teams at risk run Tailscale SSH with forwarding allowed, app connectors, or a self-hosted headscale reachable from the internet. Tailscale confirmed the issues are real and serious, mostly privilege escalation. Fixes are merged on main, and Tailscale aims to ship a patched client by the end of 2026-10-27. As of 2026-10-27 there is no CVE and no numbered fixed release. No attacks in the wild have been reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tailscale affected <= 1.104.2 fixed ?
- vendor:headscale affected <= 0.29.6 fixed ?

## How to check

- Check whether Tailscale SSH is on: run tailscale status / tailscale debug prefs (RunSSH), or look at the admin console for nodes with SSH enabled and for ssh rules in the tailnet policy file.
- Check the client version: tailscale version <= 1.104.2 is affected. For headscale, <= 0.29.6 is affected.
- Look for broad SSH rules (identity-wide or tag-wide accept rules) and for rules that allow forwarding.
- Check for app connectors (conn25) in use, for tailscale serve forwards that point at Unix sockets, and for headscale reachable from the internet.
- Hunting: Unix sockets created under /tmp, /run/user or home directories by tailscaled during SSH sessions. Unexpected new tagged nodes or auto-approved routes in the tailnet. Indicators of compromise: unknown.

## Fix

- Update the Tailscale client as soon as the patched release ships (Tailscale is aiming for 2026-10-27). For headscale, watch for a release that includes PR #3586.
- Until then, run tailscale set --ssh=false on nodes that do not need Tailscale SSH. Make sure you have another way in first.
- Replace identity-wide and tag-wide SSH rules with grants that name one source and one target, and set forwarding to false in each SSH rule.
- On headscale 0.29.5, forwarding cannot be turned off, so treat every SSH grant as root-equivalent.
- Remove unused app connector permissions and serve forwards to Unix sockets. Turn on node-key expiry and Tailnet Lock.
- If a node is compromised, delete it at the control plane. Reimaging the host alone is not enough.

## Timeline

- 2026-10-27T06:32:16+00:00 analyst

## Documents

- [describes] @TheHackersNews: ‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real.

Its new investi https://x.com/TheHackersNews/status/2114961487999750239
- [describes] Tailworm: Security Assessment Report — Tailscale v1.104.2 and headscale v0.29.5 (Cyberdione Labs) https://tailworm.com/
- [describes] Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
- [discussion] Tailworm – Tailscale Vulnerabilities https://news.ycombinator.com/item?id=50227138
- [discussion] @sans_isc: SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.j https://x.com/sans_isc/status/2114560289186476291
- [discussion] @TheHackersNews: ‼️ Tailscale SSH (Tailworm)

Researchers report that a compromised, SSH-authoriz https://x.com/TheHackersNews/status/2114672008097378648

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_