Tailscale Prepares Patches for Tailworm Privilege-Escalation Flaws
Summary
A Cyberdione Labs report describes 11 Tailworm findings affecting Tailscale and headscale, including SSH flaws that researchers say enabled wormable privilege escalation in lab tests. Tailscale said fixes were pending release and advised reviewing SSH policies.
Key points
- The report lists 11 findings affecting Tailscale client 1.104.2 and headscale 0.29.5; six are rated high severity.
- Four high-severity findings concern Tailscale SSH forwarding operations performed with root privileges and safeguards researchers say can be bypassed.
- In lab tests, an attacker who had compromised a device could reportedly gain root access on permitted servers and steal keys usable to add rogue devices.
- Researchers said an automated attack could spread between servers allowed by SSH policy in under a second per hop, without user interaction.
- Other reported issues could expose cloud metadata services or internal networks, reveal a node’s administrative interface to remote peers, or cause denial of service.
- Tailscale said fixes were in place for most issues and aimed to release a patched client by October 27, pending testing; the report said some fixes were in public repositories but not yet in a numbered release.
- Tailscale advised reviewing SSH access policies and disabling forwarding where unnecessary. Neither Tailscale nor the report mentioned exploitation in the wild.
Article Details
- Vulnerability Types
- Privilege escalation
- Access-control bypass
- Denial of service
- Severity
- Six findings are rated high severity; four concern Tailscale SSH.
- Affected Versions
- Tailscale client 1.104.2
- headscale 0.29.5
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Review SSH access policies and disable SSH forwarding where it is not needed.
MITRE ATT&CK
T1021.004 · SSHThe reported wormable attack moved between servers that the access policy permitted the device to reach using Tailscale SSH.T1068 · Exploitation for Privilege EscalationThe reported Tailscale SSH flaws can let an attacker with an initial foothold gain root access on reachable target servers.T1210 · Exploitation of Remote ServicesThe report describes chaining the flaws to exploit reachable servers across the Tailscale network.T1499 · Endpoint Denial of ServiceThe report says flaws in the app connector, Serve feature, headscale, and relay component could cause denial-of-service conditions.
People
Vendors
Products
HeadscaleIt lists 11 findings affecting version 1.104.2 of the Tailscale client and version 0.29.5 of headscale, an open source control server that organizations can host themselves.Tailscale clientIt lists 11 findings affecting version 1.104.2 of the Tailscale client and version 0.29.5 of headscale, an open source control server that organizations can host themselves.Tailscale SSHTailscale is getting ready to ship a client update that addresses privilege escalation weaknesses in Tailscale SSH.