Tailscale 1.104.4 fixes SSH flaws reaching root-only sockets
Original title: Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
A policy-permitted SSH session could swap socket paths and reach Docker or the local API; no real attacks are reported.
Tailscale released 1.104.4 to fix Tailscale SSH flaws that let an already permitted session reach root-only sockets because forwarding ran as root. Erica Windisch of Cyberdione Labs published the Tailworm report after lab tests; Tailscale says it reproduced the main issues and rejects calling the chain a worm. Four bulletins, TS-2026-014 through TS-2026-017, have no CVE ids. Headscale 0.29.5 does not fix the reported issues.
Unconfirmed: No CVE scores or oldest affected versions are stated, and Tailscale disputes the worm description.
- The attacker needs a policy-allowed SSH session with forwarding enabled.
- In tests, the Docker socket yielded a root shell and /etc/shadow.
- 1.104.4 forwards as the logged-in user and uses OS file permissions.
- TS_SSH_DISABLE_FORWARDING=1 turns off forwarding without disabling Tailscale SSH.
- Check mode does not stop forwarding inside an already approved session.
Impact: Permitted SSH sessions can reach root-only sockets and node control
| Product | Affected | Fixed in |
|---|---|---|
| Tailscale | — | 1.104.4 |
| Tailscale headscale | 0.29.5 does not fix the reported issues | — |
- 1.Update Tailscale SSH to version 1.104.4 or later.
- 2.If you cannot update, set TS_SSH_DISABLE_FORWARDING=1 and restart tailscaled.
- 3.Review SSH access rules so only required users and devices can connect.
- Vendors
- Tailscale
- Products
- Tailscale SSHheadscale
- Organizations
- Cyberdione Labs
From the original article
5 min read at thehackernews.com
Tailscale has released version 1. 104. 4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.