Tailscale has released version 1.104.4, the patched client promised after researcher Erica Windisch of Cyberdione Labs published the “Tailworm” findings. We covered the unpatched report on 25 October and the company’s confirmation on 27 October. The release closes the SSH socket-forwarding flaws, in which a permitted SSH session could reach files and services that only the root user should be able to touch.
According to Tailscale’s bulletin, the SSH server inside the root-privileged tailscaled process checked Unix socket paths but then carried out the forwarding as root. That allowed privileged connections, let a remote forward remove root-owned sockets, and a timing race let an attacker swap the path after the check. The bulletin says an attacker could reach root-only sockets such as the Docker socket or the tailscaled local API. The attacker needs a device that the network’s access rules already allow to open an SSH session with forwarding permitted; Tailscale says the flaws do not let an unauthenticated attacker connect to arbitrary Tailscale SSH servers. In 1.104.4 the server performs forwarding as the logged-in user and relies on the operating system’s file permissions.
The release covers four security bulletins. TS-2026-014 is the SSH socket-forwarding issue. TS-2026-015 is a memory-exhaustion bug in SSH session handling that can crash tailscaled and cut every Tailscale connection on that node. TS-2026-016 is in tailscale serve, where a forward to a Unix socket could reach the tailscaled local API, which the bulletin says allowed full node takeover. TS-2026-017 is a race in tailscale serve with TLS that could send one mount’s permission headers to a request for another mount.
How to check if you’re affected
Affected versions are Tailscale clients older than 1.104.4, on nodes that match the bulletin conditions. The bulletins say:
- TS-2026-014 and TS-2026-015: nodes running the Tailscale SSH server, and for 014, with local or remote forwarding allowed in the access policy. THN reports the Tailscale SSH server runs only on Linux and the open-source macOS build.
- TS-2026-016: nodes using
tailscale servewith Unix socket backends, where a local operator can write serve configuration or local users can write to the backend paths. - TS-2026-017: nodes using
tailscale servewith TLS and at least two mounts with different capability requirements.
Check the Tailscale version on each affected device and upgrade to 1.104.4 or newer. If you cannot update a server yet, Tailscale says you can set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service, which disables SSH forwarding without disabling Tailscale SSH. Tailscale also recommends limiting SSH access rules to the users and devices that need them. The bulletins describe fixes for the Tailscale client; they do not describe a fix for the self-hosted headscale control server that the Tailworm report also tested.