Tailscale warns of SSH flaws allowing root privilege escalation

Tailscale is racing to patch a set of security flaws in Tailscale SSH and several adjacent features, some of which let an already-authorized user escalate to root code execution. The company published a preliminary investigation update on October 26, confirming the issues and shipping mitigations ahead of a fix. No CVE IDs have been assigned yet, and Tailscale says a patched client release is targeted for the end of Tuesday, October 27, "subject to successful completion of testing."

The researcher collective Cyberdione Labs, whose founder Erica Windisch reported the findings, groups them as 11 flaws under the name "Tailworm" and has published details at tailworm.com. Tailscale's own page credits "external security specialists" without naming them.

What's affected

Per Cyberdione's writeup, the flaws were verified against Tailscale v1.104.2 and headscale v0.29.5 (the open-source control server). Tailscale has not published the full affected range; treat all current deployments as exposed until the patched client lands. The issues span five components:

• Tailscale SSH — Unix-socket forwarding performs path checks and file operations as root. Races plus a missing privilege drop let an authorized session gain root code execution, capture enrollment keys, or delete arbitrary root-owned files. Exploitation requires one approved device and one SSH policy rule.
• App connectors (conn25, experimental) — traffic can be steered to attacker-chosen destinations without validation, enabling cloud metadata credential theft and internal-network access.
• headscale control server — unauthenticated resource exhaustion can crash the server and block new-device onboarding.
• DERP client — an unbounded read from a malicious relay can exhaust client memory.
• tailscale serve — a TCP-forward to a Unix socket lacks a guard present on the HTTP path, and a race in per-mount authorization allows remote administrative API access.

Exploitation status

Neither Tailscale nor Cyberdione reports exploitation in the wild. This is coordinated disclosure with a same-day fix target, not an active-attack advisory — but full technical details are public at tailworm.com, so the window between disclosure and patching is the exposure to manage.

Action checklist

1. Apply the patched Tailscale client as soon as it ships (targeted for Oct 27). Watch the investigation update page for the release.
2. Mitigate now, before the patch: set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. Tailscale says this disables SSH forwarding — the vector behind several of the most serious findings — without disabling Tailscale SSH entirely.
3. Review SSH access policies and limit access to only the users and devices that need it. Exploitation of the SSH bugs needs an approved device and a matching policy rule, so least privilege shrinks the blast radius.
4. headscale operators: prioritize the control-server fix once available; the DoS path is unauthenticated.
5. Tailscale does not recommend that everyone disable Tailscale SSH outright — tighten forwarding and policy instead.

Context

Tailscale sits inside the trust boundary for a large number of teams that use it as their default remote-access and zero-config VPN layer, which makes a root-privesc chain in its SSH path a wide-reaching problem even without in-the-wild activity. The practical takeaway is narrow: the forwarding mitigation is free and reversible, so there is no reason to wait for the client release to apply it.