Tailscale is working to fix 11 security vulnerabilities that could allow attackers to steal credentials, crash servers, access internal services, and gain root privileges. The flaws, collectively called tail worm, affect Tailscale 1.104.2 and self-hosted Headscale v0.29.5 control servers, according to Cyberdione Labs.
Tailscale provides a software-defined mesh virtual private network (VPN) built on WireGuard. It allows computers, servers, and cloud instances to connect to the same encrypted mesh network, known as a “tailnet,” from anywhere through direct peer-to-peer (P2P) connections.
Cyberdione Labs identified the 11 vulnerabilities during a security audit of Tailscale 1.104.2 and self-hosted Headscale v0.29.5. The researcher said the issues remained unpatched in the versions tested.
“All findings were validated by reproduction in a lab environment on unmodified released software (tailscale v1.104.2, headscale v0.29.5),” said Erica Windisch, founder of Cyberdione Labs. Windisch reported the flaws to Tailscale and published the details.
“It is the researcher’s opinion that rapid recognition of these flaws will result in faster remediation across affected devices. These vulnerabilities were not introduced by researchers; they were discovered and discovered with less effort.”
What the Tailscale vulnerabilities affect
The most severe issue affects Tailscale’s built-in SSH server. An authorized attacker could potentially execute code with root privileges on a target system by using Unix socket forwarding within the target’s tailnet.
| Component or function | How it works | Attacker requirements | Potential impact |
|---|---|---|---|
Tailscale SSH (the root-running SSH server built into tailscaled) |
Unix socket forwarding using ssh -R or -L performs path checks and file operations as root. Conflicts or missing privilege checks can allow privileged resources to be replaced, accessed, or removed during a normal session. |
One authorized device and one SSH policy rule. Forwarding is automatically allowed in Headscale and is controlled by a policy rule in the SaaS version. | Root-level code execution on the target server, capture of the registration key, and deletion of arbitrary root-owned files. |
Tailscale app connectors (conn25, experimental) |
The connector can direct traffic to an attacker-selected destination without verifying it. Network ACLs are not referenced for the actual destination. | A device with connector functionality enabled. | Access to cloud metadata and credentials, internal LAN resources, and Kubernetes cluster services. |
| Headscale control server (self-hosted deployments) | Unauthenticated requests can exhaust resources by increasing memory usage and removing cache data. | Internet reachability; no account is required. | Control-server crash loops and an organization-wide inability to onboard new devices. |
| Tailscale DERP client (the relay connection used by each agent) | The client permits unrestricted reading of malicious relay responses. | The ability to place clients on, or direct them to, hostile relays. | The client agent can run out of memory. |
| Tailscale Serve (local service exposure) | TCP forwarding to Unix sockets lacks safeguards present in HTTP paths. Authorization conflicts can also occur for mounts. | An operator configures forwarding, or a peer creates a conflicting mount. | Remote access to node management APIs and the ability to bypass application authentication for a small number of requests. |
Tailscale response and recommended mitigations
The Tailscale team said Monday that it had received the Cyberdione Labs report and was working on a patch to address the vulnerabilities later that day.
The developers acknowledged that the reported issues were “severe” because they could allow an attacker with privileges on a targeted system to perform actions with elevated privileges.
“Most of the Tailscale SSH issues we’ve identified are related to privilege escalation. In some situations, users who are already allowed to connect via Tailscale SSH could be able to perform actions beyond the configured local user permissions, including potentially gaining elevated privileges,” Tailscale said.
“These are serious security issues and we are addressing them accordingly. Exploitation depends on the privileges granted to the connecting user or device, the configuration of the system, and other conditions. We continue to examine the full scope of our findings and which configurations may be affected.”
Despite the severity of the issues, Tailscale said it does not recommend that users disable Tailscale SSH entirely.
“Let’s move on to the most important part: Based on our current evaluation, we do not recommend that everyone disable Tailscale SSH,” said Mike Shaver, Tailscale’s vice president of engineering, in a Reddit post.
Instead, Tailscale recommended the following steps to reduce exposure while users wait for patched releases:
- Review SSH access policies. Limit access to the users and devices that require it.
- Disable SSH forwarding if it is not needed. Set
TS_SSH_DISABLE_FORWARDING=1in the Tailscale service environment and restart the service. This disables SSH forwarding without disabling Tailscale SSH completely and addresses some of the more serious issues. - Verify access to sensitive systems. While investigating, consider temporarily tightening Tailscale SSH policies so that only specifically authorized users and devices can connect.
Tailscale developers aimed to release a version containing fixes by the end of Tuesday, October 27, and urged users to prepare for updates and “apply patched Tailscale client releases as they become available.”
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com