Unpatched Tailscale SSH flaws can yield root from one compromised device
Original title: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
Lab tests on Tailscale 1.104.2 and headscale 0.29.5 found no CVE, bulletin, or fix as of October 25.
Erica Windisch of Cyberdione Labs published the Tailworm report on October 25 after lab tests of Tailscale 1.104.2 and headscale 0.29.5. With Tailscale SSH port forwarding allowed and a foothold on one permitted device, she gained root and, where Tailnet Lock was off, enrolled an attacker machine. Tailscale vice president Mike Shaver said the company is fixing related issues and is not telling everyone to disable Tailscale SSH. The proof of concept is not public, and Tailscale has not confirmed the specific claims.
Unconfirmed: Tailscale has not confirmed the claims, no one else has publicly reproduced them, and some researchers dispute the "wormable" label.
- Windisch tested Tailscale 1.104.2 and headscale 0.29.5 over three days in a lab.
- On headscale 0.29.5, SSH forwarding cannot be turned off at all.
- Enrollment-key abuse completed only when Tailnet Lock was not enabled.
- The report lists 11 findings, including experimental app connector conn25.
- She says she sent the report and PoC to Tailscale the Saturday before publication.
Impact: root on reachable Tailscale SSH targets from one foothold
| Product | Affected |
|---|---|
| Tailscale | 1.104.2 (tested) |
| Tailscale headscale | 0.29.5 |
- 1.Write Tailscale SSH rules as single source-to-destination device pairs.
- 2.On Tailscale's hosted service, turn off SSH port forwarding per rule.
- 3.Treat every headscale 0.29.5 SSH grant as root on the target until a fix exists.
- Vendors
- Tailscale
- Products
- headscaleTailscale SSH
- Organizations
- Cyberdione Labs
From the original article
5 min read at thehackernews.com
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.