Researcher Says Tailscale SSH Flaws Could Enable Root Access Across Permitted Servers

Oct 25, 2026 · Original article ↗

Summary

A researcher reports lab-tested Tailscale SSH flaws that could turn a compromised, permitted device into root access on reachable servers. Tailscale says it is investigating; the specific claims remain unconfirmed and no fix is available.

Key points

Erica Windisch's Tailworm report describes tests of Tailscale 1.104.2 and headscale 0.29.5 in a lab; the findings have not been publicly reproduced, and Tailscale has not confirmed the specific technical claims.
The reported attacks require Tailscale SSH port forwarding and an attacker-controlled device that access rules permit to reach the target; they do not provide the initial foothold.
One lab method reportedly used SSH forwarding to make a root-level Tailscale process access a privileged system socket, enabling root access and reading the system password file.
Other methods reportedly involved replacing a root-owned socket and racing a file-path safety check; the latter captured a device-enrollment key and enabled network access as a trusted server when Tailnet Lock was disabled.
Windisch says the lab demonstrations spread across devices permitted by access rules in under a second per step; this was not observed on real networks, and some researchers dispute the “wormable” characterization.
The report says single source-to-destination access rules and hardware-bound device keys limited spread. On headscale 0.29.5, forwarding cannot be disabled; Tailscale's hosted service allows it to be disabled per rule.
Tailscale says it is working on fixes, but had issued no security bulletin or fixed version at publication. Check mode adds a login step but does not fix the reported privilege escalation.

Article Details

Attack Vectors: The reported SSH privilege-escalation chain requires an already-compromised device that access rules permit to connect to a target, plus Tailscale SSH configured to allow port forwarding.
In lab testing, SSH port forwarding caused the root-level Tailscale process to access a root-only system socket, enabling the researcher to gain root access.
The report describes replacing a root-owned socket with an attacker-controlled socket to execute root commands against certain services.
The report describes a race between checking and using a forwarded file path to bypass a file-access safety check, capture a device-enrollment key, and join an attacker-controlled machine to the network as a trusted server. The final enrollment step worked only when Tailnet Lock was disabled.
The report says the experimental conn25 app connector feature could let a permitted user route traffic to unapproved destinations, including a cloud provider's metadata service. The specific technical claims have not been independently reproduced or confirmed by Tailscale.
Defensive Notes: On Tailscale's hosted service, disable forwarding in each applicable rule. The report says forwarding cannot be disabled on headscale version 0.29.5 and recommends treating every SSH grant there as granting root access to its target.
Use access rules limited to single source-to-destination pairs; the report says this constrained spread in its lab tests.
Enable Tailnet Lock; the report says the final device-enrollment step did not complete on networks where it was enabled, although needed secrets were captured in transit.
Use device keys tied to hardware such as a TPM or Secure Enclave, which the report identifies as a barrier to the attack.
Tailscale recommends enabling SSH check mode and automatic updates. The report cautions that check mode adds a login step but does not fix the privilege-escalation issue.
At publication, Tailscale had not issued a security bulletin or fixed version. The reported findings were based on lab testing and had not been independently reproduced; Tailscale had not confirmed the specific technical claims.