Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Unpatched Tailscale SSH flaws can give authorized users root

Original title: Tailscale warns of SSH flaws allowing root privilege escalation

BleepingComputerby Sergiu Gatlan ()3 min read1
Read at bleepingcomputer.com
Part of a story covered by 8 sourcesTailscale ships 1.104.4 for SSH root flaws; headscale unfixedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Cyberdione Labs detailed 11 Tailworm issues in Tailscale 1.104.2 and headscale v0.29.5; patches were expected October 27.

Cyberdione Labs publicly reported 11 vulnerabilities, collectively called Tailworm, after auditing Tailscale 1.104.2 and self-hosted headscale v0.29.5. The most serious is in Tailscale SSH: a user already allowed to connect can race Unix-socket forwarding and run code as root, capture enrollment keys, or delete root files. Other issues include unauthenticated headscale crashes, app-connector traffic that skips ACLs, and memory exhaustion via a hostile DERP relay. Tailscale called the flaws serious, did not advise disabling Tailscale SSH, and aimed to ship fixes by the end of October 27.

Unconfirmed: Tailscale said it was still verifying the full scope and which configurations are affected.

Key facts
  • Findings were reproduced on unmodified tailscale v1.104.2 and headscale v0.29.5.
  • Headscale grants SSH forwarding automatically; SaaS Tailscale does so per rule.
  • TS_SSH_DISABLE_FORWARDING=1 turns off forwarding without disabling Tailscale SSH.
  • No CVE identifiers are given in the report.
Security assessment · AI, from the articlePublic proof of concept

Impact: Root code execution and enrollment-key theft for authorized SSH users

ProductAffected
Tailscale1.104.2
headscalev0.29.5
What to do
  1. 1.Set TS_SSH_DISABLE_FORWARDING=1 for tailscaled and restart the service.
  2. 2.Limit Tailscale SSH to users and devices that need it.
  3. 3.Install the patched Tailscale client when the vendor releases it.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1068 Exploitation for Privilege Escalation
Tags
tailscaleheadscalesshprivilege-escalationwireguard
Vendors
Tailscale
Products
headscaleTailscale SSH
Organizations
Cyberdione Labs

From the original article

3 min read at bleepingcomputer.com

The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]

BleepingComputer

By Sergiu Gatlan · bleepingcomputer.com

Read the full article at BleepingComputer

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.