Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes
Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscale
Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has published no bulletin, CVE or fix yet; it is lateral movement from a foothold, not internet RCE.
Why this severity: Researcher-rated High: root on SSH targets from one approved device plus an SSH rule; needs an existing foothold; not yet confirmed by Tailscale
- Started
- Oct 25, 2026
Affected
- tailscale v1.104.2 (tested)
- headscale v0.29.5 (tested)
Fixed in
No fixed release yet
Timeline2
Erica Windisch (Cyberdione Labs) publishes the Tailworm report on Tailscale's open-source client and headscale, tested Oct 22-24 on unmodified releases. She says the issues were reported upstream but not coordinated, and recommends disabling Tailscale SSH and App Connectors.
The report reaches Hacker News, where a Tailscale engineer says the team has been working on it and more details will follow. Tailscale's security bulletins list no entry for it yet (latest is TS-2026-013, the eMudhra distrust).
Advisories1
News & write-ups3
Posts1
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node. t.co/pK4NPIOd9g
Get an email when a new major security incident drops. No spam, unsubscribe any time.
