Tailworm report says Tailscale SSH flaws could turn one compromised device into root access
Security researcher Erica Windisch’s Tailworm report says flaws in Tailscale SSH and headscale could let an attacker with access to one permitted device gain root privileges on reachable servers. The demonstrations were conducted in a lab, not on real networks; Tailscale has not confirmed the specific findings, and no bulletin or fixed version had been issued at publication.
Bottom line — Windisch’s lab tests found spread in under a second per hop, but source-to-destination access rules limited how far it could reach.
Go deeper 7
-
Windisch tested Tailscale 1.104.2 and headscale 0.29.5 between 22 and 24 October 2026, according to Cyber Security News.
-
The report describes Unix socket abuse, socket replacement and a timing flaw that redirects privileged file operations.
-
The attack requires Tailscale SSH and relevant forwarding permissions; Tailscale’s hosted service allows forwarding to be disabled per rule, while headscale 0.29.5 does not, the report says.
-
Cyber Security News reports that narrow source-to-destination rules stopped the spread in the lab.
-
A chain captured a device-enrolment key and registered an attacker-controlled device in a lab network without Tailnet Lock, according to The Hacker News.
-
Windisch’s report also describes separate issues in the experimental conn25 app connector, Tailscale Serve and headscale.
-
Tailscale engineering vice-president Mike Shaver said the company had received the report, was investigating related areas and was working on fixes, The Hacker News reported.