580/69 Monday, October 26, 2026
A security vulnerability has been reported in Tailscale SSH that could allow an attacker who has already compromised one device on a network to use it as a foothold to gain elevated, potentially root-level access to other servers within the same network. The issue was disclosed by security researchers from Cyberdione Labs under a research project named Tailworm. Researchers warned that the vulnerability is particularly relevant to enterprise network administrators because it could enable attackers to rapidly expand their access within an internal network. At the time of disclosure, no CVE identifier had been assigned and no official patched version had been released by the developer.
According to a security assessment conducted between October 22 and 24, 2026, the issue was rated High severity and was identified in Tailscale version 1.104.2 and headscale version 0.29.5. Exploitation requires SSH port forwarding to be enabled in Tailscale SSH, and the attacker must first control a device that is permitted by the network’s access rules to connect to the target. Researchers found that an attacker could abuse Tailscale’s connection handling to access system sockets, potentially allowing sensitive files to be read and commands to be executed with root privileges without requiring an additional password or authentication key. Tailscale representatives have acknowledged the report and are investigating the technical issue with external security experts.
To reduce potential exposure, administrators should immediately review and strengthen their Tailscale security configurations. Tailscale SSH access rules should be restricted to explicit source-to-destination device pairs, while overly broad authorization rules should be removed. SSH port forwarding should also be disabled where it is not required. In addition, administrators should revoke App Connector privileges from unused devices, remove forwarding configurations that point to Unix sockets, and enable node-key expiration. If a device is found to have been compromised, it should be removed from the control plane immediately, as reinstalling the operating system on the same device may not invalidate keys that an attacker has already copied.
Source: https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html