Tailworm: unpatched Tailscale SSH flaws. Tighten your ACLs now.

A researcher published 11 findings against Tailscale this weekend, and there is no patch yet. The report, called Tailworm, says that with Tailscale SSH and port forwarding turned on, one compromised device can get root on other servers it is allowed to reach. Tailscale has not confirmed the details. It has said it received the report and is working on fixes. If your small team uses Tailscale SSH to reach servers, you have work to do today that does not depend on a patch.

What actually happened

Erica Windisch of Cyberdione Labs tested Tailscale v1.104.2 and headscale v0.29.5, the self-hosted control server, from October 22 to 24. The report covers Tailscale SSH, Serve and Funnel, the DERP relay, the experimental conn25 app connector, and headscale.

The SSH chain, per the report and The Hacker News:

• Start point: an attacker already controls one device in your tailnet, through a bad dependency or a hacked web app, and an ACL rule lets that device SSH to a target with forwarding allowed.
• Escalation: SSH forwarding makes the root-level tailscaled process connect to root-only Unix sockets. In the lab, that gave root on the target.
• Spread: a race condition captured a device enrollment key, so an attacker machine could join as a trusted node. That last step failed on tailnets with Tailnet Lock turned on.

On headscale 0.29.5, the report says forwarding cannot be turned off at all.

Tailscale VP of Engineering Mike Shaver said on Reddit that the company got the report, had already been looking at the same areas, and found issues it is fixing. He said Tailscale is "not recommending that everyone disable Tailscale SSH." The Tailscale security bulletins page has no entry for these findings yet. The newest is TS-2026-013 from October 21.

Two cautions. The findings come from one researcher, and nobody has reproduced them in public. The proof-of-concept code went only to Tailscale. The disclosure was also fast, which some researchers criticized.

Why the Tailscale SSH findings matter for your business

Small teams write broad ACLs. "Group admins can SSH to tag:servers as root" is the rule most of us start with. The report says the one control that stopped the spread was writing SSH grants as single source-to-destination pairs. That is more lines of policy. It is also cheap.

Do this today:

1. Rewrite SSH rules as per-pair grants, one device to one target.
2. Turn off SSH port forwarding in each rule where nobody needs it.
3. Turn on Tailnet Lock if you have not.
4. Turn on node key expiry, and remove any tailscale serve that points at a Unix socket.
5. If you run headscale, treat every SSH grant as root on that box until a fix ships.

Check mode is not a fix. Tailscale suggests check mode and auto-updates. Check mode adds a login step. It does not stop the escalation once a session is open.

Sources: Tailworm report (Cyberdione Labs), The Hacker News, Tailscale security bulletins.