The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
Tailscale develops a software-defined mesh virtual private network (VPN) built on WireGuard that lets users connect computers, servers, and cloud instances from anywhere to the same encrypted mesh network ("tailnet") via direct peer-to-peer (P2P) connections.
Cyberdione Labs discovered 11 flaws (collectively known as Tailworm) that still lack patches during a security audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server.
"All findings were verified by reproduction in a lab environment on unmodified, released software (tailscale v1.104.2, headscale v0.29.5)," said Erica Windisch, founder of Cyberdione Labs, who reported the flaws to Tailscale and publicly released the details.
"It is the opinion of the researchers that rapid awareness of these flaws will expediate remediation across impacted devices. These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort."
The table below classifies the security issues by the component they affect. The most critical issue is in Tailscale's SSH server and could let authorized attackers gain code execution with root privileges through Unix-socket forwarding on a targeted tailnet.
| Component / feature | Mechanism (what breaks) | Attacker requirement | Principal outcome |
|---|---|---|---|
| Tailscale SSH (tailscaled's embedded SSH server, running as root) | Unix-socket forwarding (ssh -R/-L) performs path checks and file operations as root; races and missing privilege drop let an ordinary session replace, dial, or delete privileged resources |
One approved device + one SSH policy rule (forwarding granted automatically on headscale; per-rule on SaaS) | Root execution on target servers; capture of enrollment keys; arbitrary root-file deletion |
| Tailscale app connectors (conn25, experimental) | Connector translates traffic to attacker-chosen destinations with no validation; network ACLs are never consulted for the true destination | A device granted the connector capability | Reach cloud metadata (credential theft), internal LANs, and — in Kubernetes — every cluster service |
| headscale control server (self-hosted deployments) | Unauthenticated resource exhaustion (memory growth, cache eviction) | Internet reachability; no account | Control-server crash loop; blocking of new-device onboarding org-wide |
| Tailscale DERP client (relay connection in every agent) | Unbounded read of a malicious relay's response | Ability to position/point a client at a hostile relay | Client-agent memory exhaustion |
| tailscale serve (local service exposure) | TCP-forward to a unix socket lacks a guard present on the HTTP path; plus a race in per-mount authorization | Operator configures the forward (or a peer races the mount check) | Remote administrative-API access to the node; minority of requests bypass app authz |
On Monday, the Tailscale team said it received Cyberdione Labs' report and was working on patches to address these security issues by the end of today.
The developers also confirmed that the reported flaws are "serious" as they could let threat actors with permissions on targeted systems take actions with escalated privileges.
"Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges," Tailscale said.
"These are serious security issues, and we're treating them accordingly. Exploitation depends on the permissions granted to the connecting user or device, the system's configuration, and other conditions. We're continuing to verify the full scope of the findings and which configurations may be affected."
However, despite the severity of the issues, Tailscale said it doesn't recommend that users disable the Tailscale SSH feature.
"If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH," said Mike Shaver, VP of Engineering at Tailscale.
Instead, the Tailscale team shared measures that should mitigate some of these flaws:
- Review SSH access policies. Limit access to the users and devices that need it.
- Disable SSH forwarding if you don't need it. Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This disables SSH forwarding without disabling Tailscale SSH entirely, and mitigates several of the more serious findings.
- Review access to sensitive systems. Consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
The Tailscale devs aim to push a new version that fixes these issues by the end of Tuesday, October 27, and urged users to prepare to update and "apply the patched Tailscale client release when it becomes available."
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report