● Covered by 4 sources · 5 reportsMedium impact1 negative4 neutral
Unpatched Tailscale SSH Flaws Allow Root Access on Other Servers From a Hacked Device
Key points
- A hacked device can gain root access on other Tailscale SSH servers.
- Attack requires Tailscale SSH port forwarding and initial device compromise.
- Vulnerabilities were reported by Erica Windisch of Cyberdione Labs.
- Tailscale is investigating the issues and working on fixes.
- 11 security vulnerabilities were discovered.
- The vulnerabilities are collectively named 'Tailworm'.
- Vulnerabilities were found in Tailscale 1.104.2 and headscale v0.29.5.
- Six findings are rated high severity.
- Four high-severity findings concern Tailscale SSH.
- Tailscale SSH performs some forwarding operations with root privileges.
- Tailscale plans a targeted release by October 27th.
- Tailscale released version 1.104.4 to fix the flaws.
- Tailscale SSH server runs only on Linux.
Vulnerability Details Revealed
Security researcher Erica Windisch of Cyberdione Labs published findings this week detailing unpatched flaws in Tailscale SSH. The report, named Tailworm, indicates that a single compromised device on a Tailscale network can be used to achieve root access on other reachable servers.
The attack necessitates two conditions: Tailscale SSH configured to permit port forwarding, and an attacker already controlling a device that has access rules allowing connection to the target server. Windisch tested Tailscale version 1.104.2 and headscale version 0.29.5 in a lab environment.
Attack Mechanism
Unlike traditional SSH, Tailscale SSH identifies devices rather than checking user credentials, with access rules determining device-to-target SSH sessions. This design means the attack does not require stolen passwords or keys.
An initial foothold on one device is necessary, which the report suggests can be obtained through common methods such as vulnerable web applications, poisoned software, phishing, or stolen login details. Tailscale itself does not create this initial compromise.
Impact on Network Configurations
The ability to mitigate this vulnerability varies depending on the network's setup. On Tailscale's hosted service, port forwarding can be disabled per rule. However, in headscale version 0.29.5, port forwarding cannot be turned off, meaning every SSH grant should be considered as providing root access on the target.
Windisch demonstrated the problem in a lab, showing that a standard SSH port forwarding session could cause the root-level Tailscale process to connect to a system socket, allowing root access and reading of the system password file without administrator rights.
Tailscale's Response
As of the report's publication, Tailscale had not issued a security bulletin, CVE identifier, or a fixed version. However, Mike Shaver, Tailscale's vice president of engineering, stated on Reddit that the company received the report and was already investigating similar areas with external security specialists.
Shaver confirmed that Tailscale found issues and is working on fixes. The company is still determining which setups are affected and is not currently recommending that all users disable Tailscale SSH.
Updates
- Tailscale released version 1.104.4 to fix the flaws.
- Tailscale SSH server runs only on Linux.
- 11 security vulnerabilities were discovered.
- The vulnerabilities are collectively named 'Tailworm'.
- Vulnerabilities were found in Tailscale 1.104.2 and headscale v0.29.5.
- Six findings are rated high severity.
- Four high-severity findings concern Tailscale SSH.
- Tailscale SSH performs some forwarding operations with root privileges.
- Tailscale plans a targeted release by October 27th.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub tailscale/tailscaleHow outlets covered it
Tailscale released version 1.104.4 to fix SSH server flaws that could allow an attacker to gain root access to services and files on other servers. These vulnerabilities, reported as "Tailworm," enabled a compromised device to exploit network connection forwarding to access root-only sockets.
Tailscale is investigating security vulnerabilities in its Tailscale SSH feature, primarily involving privilege escalation, and is preparing a patched client release. The issues could allow authorized users to gain elevated privileges beyond their configured permissions, prompting a targeted release by October 27th.
Tailscale is preparing to release a client update to address privilege escalation vulnerabilities, dubbed 'Tailworm,' found in Tailscale SSH and other components. These flaws, publicly disclosed by Cyberdione Labs, could allow an attacker to gain root access on servers and compromise network security, with some being wormable.
Tailscale is patching 11 security vulnerabilities, collectively named 'Tailworm', discovered by Cyberdione Labs in Tailscale 1.104.2 and headscale v0.29.5. The most critical flaw allows authorized attackers to gain root privileges via Unix-socket forwarding in Tailscale's SSH server, impacting users of the mesh VPN.
A security researcher identified unpatched vulnerabilities in Tailscale SSH that allow a compromised device to gain root access on other servers within the network. The attack requires Tailscale SSH to be configured for port forwarding and an attacker to control an initial device with network access to the target, posing a risk to networks using the affected configurations.