Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes ยท updates https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has published no bulletin, CVE or fix yet; it is lateral movement from a foothold, not internet RCE. en Sun, 25 Oct 2026 00:00:00 GMT Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes: Erica Windisch (Cyberdione Labs) publishes the Tailworm report on Tailscale's open-source client and headscale, tested Oct 22-24 on unmodified releases. She says the issues were reported upstream but not coordinated, and recommends disabling Tailscale SSH and App Connectors. https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc#2026-10-25-fe9b7a49 Sun, 25 Oct 2026 00:00:00 GMT high <p><a href="https://tailworm.com/">Source</a></p> Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes: The report reaches Hacker News, where a Tailscale engineer says the team has been working on it and more details will follow. Tailscale's security bulletins list no entry for it yet (latest is TS-2026-013, the eMudhra distrust). https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc#2026-10-25-6d2a39a6 Sun, 25 Oct 2026 00:00:00 GMT high <p><a href="https://news.ycombinator.com/item?id=50227138">Source</a></p>