Tailscale has now publicly acknowledged the SSH problems that researcher Erica Windisch of Cyberdione Labs published as “Tailworm” and that we described on 25 October. In an investigation update dated 26 October, the company says most of the Tailscale SSH issues it identified involve privilege escalation: someone already authorized to connect over Tailscale SSH may be able to act beyond the permissions of their configured local user, potentially gaining elevated privileges. It calls them “serious security issues” and says exploitation depends on the connecting user’s or device’s permissions, the system’s configuration and other conditions.
Tailscale says its engineers have implemented fixes for most of the issues and are finishing testing ahead of a patched client release, targeted by the end of Tuesday 27 October and subject to testing. It has not yet published a security advisory, affected versions or CVE identifiers; it says an advisory and a technical blog post will follow once fixes are out. The report itself, per BleepingComputer, lists 11 flaws found in Tailscale 1.104.2 and in the self-hosted headscale 0.29.5 control server, including unauthenticated resource exhaustion in headscale, which is separate from the SSH issues. Tailscale says that based on its current assessment it is not recommending that everyone disable Tailscale SSH.
How to check if you’re affected
Affected products are networks using Tailscale SSH, and the reported flaws were tested against Tailscale version 1.104.2 and headscale version 0.29.5. Tailscale has not yet said which versions and configurations are affected, so the steps below are the company’s interim advice:
- Review your Tailscale SSH access policies so that only the users and devices that need access can connect, and consider tightening them temporarily.
- If you don’t need SSH forwarding, set
TS_SSH_DISABLE_FORWARDING=1in the environment of thetailscaledservice and restart it. Tailscale says this disables forwarding without disabling Tailscale SSH and mitigates several of the more serious findings. - Review access to sensitive systems.
- Apply the patched Tailscale client when it is released, and check the investigation page for the update. Headscale is a separate project; this update does not describe a headscale fix.