Tailscale is preparing patches for security flaws that could let users already authorized to connect through Tailscale SSH exceed their local account permissions, potentially gaining root privileges. According to BleepingComputer’s October 27 report, the company aims to release fixes by the end of Tuesday, October 27, and has outlined interim mitigations.
Cyberdione Labs reported 11 vulnerabilities, collectively called Tailworm, following an audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. The findings span SSH, app connectors, relay connections, local service exposure and headscale. Cyberdione founder Erica Windisch said the researchers reproduced all findings in a laboratory using those unmodified releases. The report described the flaws as unpatched at publication.
Tailscale acknowledged receiving the report on Monday and called the issues serious, while saying it was still verifying their full scope and the configurations affected. Exploitation depends on the connecting user or device’s permissions, system configuration and other conditions, the company said.
SSH forwarding creates a path beyond account permissions
The reported SSH flaws involve Unix-socket forwarding in the SSH server embedded in tailscaled, which runs as root. According to the researchers’ findings as presented by BleepingComputer, path checks and file operations performed with root privileges, combined with race conditions and missing privilege drops, could let an ordinary session replace, connect to or delete privileged resources.
The reported prerequisite is one approved device and one SSH policy rule. Forwarding is granted automatically on headscale, while Tailscale’s hosted service controls it per rule. Documented potential consequences include root code execution on target servers, capture of enrollment keys and arbitrary deletion of files owned by root.
Tailscale said someone already authorized to connect through Tailscale SSH could, in some circumstances, perform actions beyond their configured local user’s permissions. That is a privilege-escalation risk following authorized access; the report does not establish that every tailnet is exposed under every configuration.
Interim measures while patches are prepared
Tailscale said its current assessment did not warrant recommending that everyone disable Tailscale SSH. Instead, it advised reviewing SSH policies, limiting access to users and devices that need it, and considering temporary restrictions for sensitive systems.
For systems that do not need SSH forwarding, the company recommended setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. It said this disables forwarding while keeping Tailscale SSH available and mitigates several of the more serious findings. Users were also urged to prepare to apply the patched client release when available.
The other reported findings have different prerequisites. A device granted the experimental conn25 app-connector capability could direct traffic to destinations without network ACL checks on the true destination, potentially reaching cloud metadata credentials, internal networks and, in Kubernetes, every cluster service. An internet-reachable headscale control server could face unauthenticated resource exhaustion, causing crash loops and blocking new-device onboarding.
The researchers also reported client memory exhaustion when an attacker can direct an agent to a malicious DERP relay. Separately, tailscale serve findings concern remote administrative-API access when an operator configures TCP forwarding to a Unix socket, and an authorization race that could let a minority of requests bypass application authorization. The supplied account describes laboratory findings and potential consequences, without reporting exploitation in the wild.
