Headscale

Security incidents tagged Headscale. Newest first.

1 Headscale incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

HighNo patch yet
Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes
Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has published no bulletin, CVE or fix yet; it is lateral movement from a foothold, not internet RCE.
Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscaleSince Oct 25, 2026updated Oct 25, 2026, 13:56 UTC

Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes
International Cyber Digest
@IntCyberDigest
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node. t.co/pK4NPIOd9g
Oct 25, 2026view on x