Unpatched Tailscale SSH Flaws Let a Compromised Device Gain Root Access Across an Entire Network

A security researcher has disclosed 11 vulnerabilities in Tailscale SSH that could allow a single compromised device to gain root access on every other server it can reach in a corporate network. The findings, published October 25 by Erica Windisch of Cyberdione Labs in a report dubbed Tailworm, affect any organization using Tailscale SSH with port forwarding enabled — a common enterprise configuration.

Tailscale is a widely deployed overlay VPN tool that builds private "tailnets" connecting devices across cloud providers, data centers, and remote workstations. Its built-in SSH feature is designed to replace traditional SSH key management for these internal connections.

What the Flaws Enable

Windisch's report demonstrates three primary attack paths. In the first, an attacker with port-forwarding access can reach root-only system sockets, exposing password files. In the second, the attacker replaces a root-owned socket with their own, enabling arbitrary command execution against certain services. The third path involves winning a timing race to capture a device-enrollment key — on networks without Tailnet Lock enabled, this lets the attacker silently add a new machine to the network as a trusted server.

An additional finding targets Tailscale's experimental conn25 app-connector feature. Windisch says this path is potentially more impactful for some organizations because it can reach unapproved destinations, including cloud metadata services — the same API endpoints that have been abused in major cloud credential theft attacks.

All of the attack paths require an initial foothold on one permitted device in the tailnet. That foothold could come from a vulnerable web application, a malicious package, phishing, or stolen credentials. Once that initial access exists, the vulnerabilities allow escalation across the network without any additional stolen passwords or keys.

Self-Hosted Headscale Users Face Greater Exposure

Organizations running Headscale 0.29.5, the open-source self-hosted alternative to Tailscale's coordination server, are in a particularly exposed position. Unlike the hosted service, Headscale has no per-rule option to disable SSH port forwarding. Windisch's report states that for Headscale deployments, every SSH access grant should currently be treated as effectively granting root on the target machine.

No Patch, No CVE

As of publication, Tailscale has not issued a patch, assigned a CVE, or published a security bulletin. The company's VP of engineering acknowledged receiving Windisch's report and said Tailscale had already been examining the same areas. He added the company is working on fixes but stopped short of recommending that users disable Tailscale SSH entirely, noting that proof-of-concept code has not been made public.

Tailscale did fix a related SSH Unix socket forwarding flaw earlier this year in version 1.98.9, which suggests the research builds on an existing line of investigation.

Mitigations Until a Fix Ships

Windisch recommends several steps organizations can take immediately: write SSH access rules as single device-to-target pairs rather than broad tag or identity-based grants; disable SSH port forwarding on the hosted service where possible; remove tailscale serve forwards that point to Unix sockets; enable node-key expiry; and remove app-connector permissions from devices that don't require them.

If a device is suspected of compromise, the correct response is deletion at the control plane, not reimaging. Reimaging alone does not revoke Tailscale keys that may have been copied during the attack window.

The findings add to a growing body of research showing that zero-trust networking overlays, while eliminating perimeter-based assumptions, can introduce new lateral-movement risks if their internal trust boundaries are not carefully scoped. Organizations relying on Tailscale for internal access control should audit their access rules against these findings until an official patch is available.

Research by Erica Windisch of Cyberdione Labs, first reported by The Hacker News.