An authorized Tailscale VPN user could take over your servers

Eleven flaws, one audit and a nickname: “Tailworm.” On the morning of Saturday, October 24, Tailscale received the results of a review that Erica Windisch, founder of the firm Cyberdione Labs, conducted on version 1.104.2 of the software and on headscale 0.29.5. headscale is an open-source control server that some organizations host themselves instead of using the commercial service. The researcher made the details public two hours later. “All findings were verified in the lab, on published, unmodified software,” she wrote.

Tailscale is a virtual private network (VPN) widely used by technical teams to connect computers and servers. Its “Tailscale SSH” feature lets users connect remotely to machines on the network, relying on Tailscale's access rules. It is where the most serious problems are concentrated. The vendor published four security bulletins, dated October 26, and a fixed version, 1.104.4. No exploitation by attackers has been reported.

How an ordinary session could act as an administrator

The core of the problem lies in the forwarding of “Unix sockets,” the local connection points that many services use. When a user requested this forwarding over SSH, Tailscale's service, which runs with maximum privileges (root), only checked the path names, then acted as root. According to Cyberdione Labs, an ordinary session could thus replace, join or delete privileged resources, up to running code as root on the server. Tailscale's bulletin TS-2026-014 cites the Docker socket and Tailscale's local interface among the possible targets.

Several conditions had to be met, however: having an approved device on the network and an SSH access rule that allows forwarding. On headscale, this forwarding is granted by default. On the commercial service, it depends on each rule. Tailscale considers these flaws “serious” and says that exploitation depends on the permissions granted to the user or device, and on the system's configuration.

More flaws, including in the control server

The audit touches other components. The tailscale serve command, which publishes a service on the network, could also reach privileged sockets (TS-2026-016). An authorized SSH session could exhaust the machine's memory, to the point of crashing Tailscale (TS-2026-015). On the headscale side, Cyberdione describes a possible overload requiring no account at all, which would block the addition of new devices across the whole organization. Finally, the experimental app connectors feature allowed a user authorized for one application to reach other internal destinations, which were never compared against those intended for that application. According to Cyberdione, version 1.104.4 does not fix this. Tailscale says this feature has not been released yet and that current app connectors are not affected.

What should you do?

The fix is a single update, provided it reaches every machine that accepts Tailscale SSH connections.

• Install Tailscale 1.104.4 or newer, starting with the servers where Tailscale SSH is enabled.
• If the update has to wait, add TS_SSH_DISABLE_FORWARDING=1 to the tailscaled service's environment, then restart it. Forwarding is turned off without disabling Tailscale SSH, which mitigates several of the most serious flaws.
• Restrict SSH access to only the users and devices that need it.
• If you host headscale, watch for a fix from that open-source project and limit its exposure to the internet.

Tailscale does not recommend turning off Tailscale SSH everywhere, said Mike Shaver, its vice president of engineering, as quoted by BleepingComputer. On October 27, the vendor said it was still verifying the full extent of the findings. Its four bulletins now describe, for each flaw, the affected configurations.