# Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes · pwn.watch > Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has published no bulletin, CVE or fix yet; it is lateral movement from a foothold, not internet RCE. Page: https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc · generated 2026-10-25T16:32:24.769Z ## Status - Severity: high · status: live · patch: unpatched - Product: Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscale - Started: 2026-10-25 - Affected: tailscale v1.104.2 (tested); headscale v0.29.5 (tested) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc/feed.xml - JSON Feed: https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc.json - This file: https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc/llms.txt ## Updates (newest first) - 2026-10-25: Erica Windisch (Cyberdione Labs) publishes the Tailworm report on Tailscale's open-source client and headscale, tested Oct 22-24 on unmodified releases. She says the issues were reported upstream but not coordinated, and recommends disabling Tailscale SSH and App Connectors. (https://tailworm.com/) - 2026-10-25: The report reaches Hacker News, where a Tailscale engineer says the team has been working on it and more details will follow. Tailscale's security bulletins list no entry for it yet (latest is TS-2026-013, the eMudhra distrust). (https://news.ycombinator.com/item?id=50227138) ## Fix brief # Security brief: Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes Source: https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc · status: live · severity: high · updated Oct 25, 2026, 13:56 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has published no bulletin, CVE or fix yet; it is lateral movement from a foothold, not internet RCE. Severity detail: Researcher-rated High: root on SSH targets from one approved device plus an SSH rule; needs an existing foothold; not yet confirmed by Tailscale - Product: Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscale ## Affected versions - tailscale v1.104.2 (tested) - headscale v0.29.5 (tested) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes No fix or CVE yet. Researcher's interim mitigations: use per-pair Tailscale SSH grants (no identity-wide or tag-wide accept rules, no root targets); on the Tailscale SaaS control plane set the per-rule SSH forwarding fields to false; on headscale v0.29.5 forwarding can't be disabled, so treat every SSH grant as root-equivalent; check mode does not stop the forwarding issues. Remove app-connector capability from clients that don't need it and put a destination allowlist or default-deny egress on connector hosts. Remove any tailscale serve TCP forward pointing at a unix socket like /run/tailscale/tailscaled.sock. For self-hosted headscale, set memory limits and keep it off the open internet. Simplest option per the researcher: disable Tailscale SSH and App Connectors until Tailscale ships fixes. ## Latest updates - Oct 25, 2026: Erica Windisch (Cyberdione Labs) publishes the Tailworm report on Tailscale's open-source client and headscale, tested Oct 22-24 on unmodified releases. She says the issues were reported upstream but not coordinated, and recommends disabling Tailscale SSH and App Connectors. - Oct 25, 2026: The report reaches Hacker News, where a Tailscale engineer says the team has been working on it and more details will follow. Tailscale's security bulletins list no entry for it yet (latest is TS-2026-013, the eMudhra distrust). ## Advisories - [Tailscale Security Bulletins](https://tailscale.com/security-bulletins) (Tailscale) ## Write-ups & news - [Tailworm: Security Assessment Report, Tailscale v1.104.2 and headscale v0.29.5](https://tailworm.com/) - [Tailworm – Tailscale Vulnerabilities](https://news.ycombinator.com/item?id=50227138) - [Tailworm: Tailscale Flaws and Who Is Exposed](https://brandefense.io/security-news/tailworm-tailscale-vulnerabilities-who-is-exposed/) --- Machine-readable: https://pwn.watch/i/tailscale-tailworm-ssh-forwarding-privesc.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.