Recent findings reveal critical vulnerabilities in Tailscale SSH, potentially enabling hackers to gain root access across servers. According to a report by Erica Windisch of Cyberdione Labs, these flaws could allow unauthorized users to move from one compromised device to others within the network without detection.
Details of the Tailscale SSH Report
The report, titled ‘Tailworm’, details 11 key vulnerabilities affecting Tailscale’s SSH server, app connector features, DERP relay client, and headscale server. Tests conducted between October 22 and October 24, 2026, on Tailscale version 1.104.2 and headscale version 0.29.5, highlight these security gaps.
One significant finding involves Tailscale SSH’s ability to forward Unix sockets with root privileges, potentially allowing unauthorized root access and exposure of sensitive files such as /etc/shadow. The report emphasizes the importance of addressing these vulnerabilities to prevent further exploitation.
Implications for Network Security
The report underscores the risk of allowing broad SSH rules, which could enable a single compromised device to affect multiple servers. Affected systems might become entry points for attackers, who could then spread across networks rapidly without needing passwords or stolen keys.
Moreover, the app connector feature poses risks by potentially allowing devices to access cloud metadata and internal Kubernetes services. This could lead to unauthorized data access and control over sensitive infrastructure components.
Preventive Measures and Recommendations
While Tailscale has yet to release an official patch, administrators are advised to follow interim security measures. These include replacing broad SSH rules with specific per-pair grants and disabling SSH forwarding where necessary. For systems using headscale 0.29.5, every SSH grant should be treated with caution due to its root-equivalent nature.
Additionally, organizations are encouraged to disable Tailscale SSH on devices that do not require it and to review app connector permissions. Implementing these steps can mitigate the risk of widespread network compromise.
As cybersecurity threats evolve, it is crucial to stay informed and proactive. Organizations should analyze the Tailworm report and monitor Tailscale’s security bulletins for updates. Adjusting security policies in light of these findings can help protect IT infrastructure from potential attacks.
