Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

The vulnerabilities, published on October 25 in a report called Tailworm, affect Tailscale SSH when configured to allow port forwarding. An attacker who already controls one device permitted by the network's access rules can exploit these flaws to gain root access to other servers. Windisch tested Tailscale version 1.104.2 and headscale version 0.29.5 over three days in a lab environment.

Tailscale SSH differs from traditional SSH by identifying devices rather than checking user passwords or keys. A single access rule determines whether a device can open an SSH session to a target. The attack requires no stolen credentials, only an initial foothold on one device through conventional means like phishing or vulnerable applications.

Multiple Attack Methods

Windisch demonstrated three distinct attack methods in her lab tests. The first used standard SSH port forwarding to cause the root-level Tailscale process to connect to a system socket normally restricted to root, allowing immediate access to system files. The second method involved replacing a root-owned socket with the attacker's own, enabling direct root command execution against certain services.

The third method defeated a safety check by racing the system between file path verification and usage. This advanced technique captured keys used to enroll new devices and could join an attacker's machine to the network as a trusted server, though only on networks without Tailnet Lock enabled.

Company Response

Tailscale has acknowledged the report, with Vice President of Engineering Mike Shaver confirming the company had already been examining similar issues with outside security specialists. Shaver stated that Tailscale is working to identify which setups are affected and is not recommending that all users disable Tailscale SSH.

Windisch disclosed the vulnerabilities to Tailscale before publication, providing both the report and proof-of-concept code to the company's security contact. She had also raised concerns with Tailscale's chief executive earlier and publicly advised users to disable Tailscale SSH.

Recommended Actions

With no patch available yet, administrators should review their Tailscale SSH access rules, writing them as single source-to-destination pairs rather than broad rules based on identity or tags. Disabling SSH port forwarding is crucial where possible—this can be done per rule in Tailscale's hosted service but cannot be disabled in headscale version 0.29.5.

Other recommended measures include removing unnecessary app connector permissions, eliminating tailscale serve forward commands pointing at Unix sockets, enabling node-key expiry, and immediately compromised devices at the control plane. Tailscale also suggests enabling SSH check mode and automatic updates as additional barriers.

The vulnerabilities represent the latest in a series of Tailscale SSH issues, with the company having fixed several similar flaws earlier in 2026. Windisch's report contains 11 findings total, including issues with Tailscale's app connectors, serve feature, and DERP relay.