Tailscale patches SSH flaws enabling lateral movement inside tailnets
Original title: Tailscale fixes SSH flaws allowing lateral movement within tailnets
Fixes shipped in Tailscale v1.104.4; abuse still requires a device the tailnet policy already allows to use SSH.
Tailscale fixed several issues, including Tailscale SSH flaws that a researcher collectively called Tailworm, in version 1.104.4. An attacker who already controls one approved tailnet device could seek root on other machines that policy permits and could steal keys used to enroll new devices. Tailscale says this is policy-limited lateral movement, not a worm. The October 23 report also covers a pre-production Conn25 flaw and denial-of-service issues against self-hosted control servers.
Unconfirmed: Tailscale disputes the researcher’s claim that access could spread automatically like a worm.
- Erica Windisch of Cyberdione Labs published the Tailworm report on October 23.
- SSH abuse cannot reach machines the tailnet policy does not already allow.
- Enrollment keys could be stolen to add a machine that looks legitimate.
- Conn25, still pre-production, is to be fixed before release.
- Internet attackers could crash self-hosted control servers or block new joins.
Impact: Root on policy-allowed tailnet hosts and theft of enrollment keys
| Product | Affected | Fixed in |
|---|---|---|
| Tailscale | — | 1.104.4 |
| Tailscale SSH | — | 1.104.4 |
- 1.Upgrade to Tailscale v1.104.4.
- 2.Review Tailscale SSH policies so only needed users and devices can connect.
- 3.Consider Tailscale SSH Check mode on sensitive systems.
- Vendors
- Tailscale
- Products
- Tailscale SSH
- Organizations
- Cyberdione Labs
From the original article
3 min read at helpnetsecurity.com
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.