Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Tailscale prepares client fix after uncoordinated Tailworm disclosure

Original title: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

SecurityWeekby Eduard Kovacs ()3 min read
Read at securityweek.com
Part of a story covered by 8 sourcesTailscale ships 1.104.4 for SSH root flaws; headscale unfixedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Six high-severity findings in client 1.104.2 and headscale 0.29.5 can yield root via SSH forwarding; no exploitation is reported.

Cyberdione Labs published 11 Tailworm findings before patches, covering Tailscale client 1.104.2 and self-hosted headscale 0.29.5. Four high-severity issues let an already authorized Tailscale SSH session bypass forwarding limits, and lab tests reached root and stole keys used to add devices. Tailscale says most fixes are ready and it aimed to release a patched client by the end of October 27. It is not telling customers to disable Tailscale SSH.

Unconfirmed: Neither Tailscale nor the Tailworm report reports in-the-wild exploitation, and a numbered patched release was not out when the report was updated.

Key facts
  • Eleven findings affect Tailscale client 1.104.2 and headscale 0.29.5.
  • Six findings are high severity, and four concern Tailscale SSH.
  • Chained lab attacks moved between permitted servers in under a second per hop.
  • Fixes were in public repositories but not yet in a numbered release.
  • Until then, Tailscale says disable unneeded SSH forwarding and review access rules.
Security assessment · AI, from the articleNo known exploitation

Impact: Root on reachable servers and theft of device-join keys

ProductAffected
Tailscale client1.104.2
Tailscale headscale0.29.5
What to do
  1. 1.Review Tailscale SSH access policies and disable SSH forwarding where it is not needed.
  2. 2.Install the patched Tailscale client once the numbered release ships.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1068 Exploitation for Privilege EscalationT1021.004 Remote Services: SSH
Tags
tailscaleheadscalewireguardsshprivilege-escalationmesh-vpn
Vendors
Tailscale
Products
headscaleTailscale SSH
Organizations
Cyberdione Labs

From the original article

3 min read at securityweek.com

Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released. The post Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws appeared first on SecurityWeek.

SecurityWeek

By Eduard Kovacs · securityweek.com

Read the full article at SecurityWeek

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.