A security researcher, Erica Windisch of Cyberdione Labs, published a report called Tailworm on October 25 describing 11 findings in Tailscale and in headscale, the self-hosted control server some networks use instead of Tailscale’s hosted service. The most serious one involves Tailscale SSH with port forwarding enabled: an attacker who already controls one device that the network’s access rules let connect to a target can, in the researcher’s lab tests, get root on that target. Windisch tested Tailscale 1.104.2 and headscale 0.29.5.
As of The Hacker News’s report, Tailscale had published no security bulletin, no CVE identifier and no fixed version. Mike Shaver, Tailscale’s vice president of engineering, wrote on Reddit that the company had received the report, had found issues it is working to fix, was still working out which setups are affected, and was “not recommending that everyone disable Tailscale SSH.” The findings rest on Windisch’s report alone: the proof-of-concept code is not public, no one else has publicly reproduced them, and Tailscale has not confirmed the specific technical claims. Windisch calls the chain “wormable” because in her lab one compromised device could spread to every device the access rules allowed, in under a second per step; that was measured in a lab, not seen on real networks, and some researchers have questioned the description. She described the disclosure as “reported but not coordinated,” and told The Hacker News she sent the report and proof of concept to Tailscale’s security contact before publishing.
How to check if you’re affected
Affected products are networks running Tailscale SSH with port forwarding allowed, and headscale servers; the report tested Tailscale version 1.104.2 and headscale version 0.29.5. No fixed version exists yet, so the steps below are configuration changes, taken from The Hacker News’s summary of the report and Tailscale’s advice:
- Review your Tailscale SSH access rules. Write them as single source-to-destination pairs naming one device and one target, and remove broad rules that grant access by identity or tag. The report says per-pair rules were the one control that stopped the spread in testing.
- Turn off SSH port forwarding where you can. On Tailscale’s hosted service this is a per-rule setting. On headscale 0.29.5 it cannot be turned off, so the report says to treat every SSH grant there as giving root on the target.
- Remove app connector permissions from devices that do not need them, and remove any
tailscale serveforward that points at a Unix socket. - Turn on node-key expiry so a stolen device key does not stay valid forever. If a device is compromised, delete it at the control plane; reimaging it does not revoke keys an attacker may already have copied.
- Tailscale also suggests enabling SSH check mode (a login step before a session starts) and automatic updates. Check mode adds a barrier but does not fix the privilege escalation.
This is not the first problem in this area: Tailscale fixed an earlier SSH Unix-socket forwarding flaw (symlink permissions allowing privileged socket access), described in its security bulletin TS-2026-004.
Sources
- Tailworm: Security Assessment Report, Tailscale v1.104.2 and headscale v0.29.5
- Tailscale security bulletins (TS-2026-004: SSH Unix socket forwarding and symlink permissions)
- Reddit r/Tailscale: recent Tailscale vulnerability reports (Tailscale response, as cited by The Hacker News)
- The Hacker News: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers