Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Tailscale Patches SSH Flaws Allowing Root Access

6 sources · 6 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Tailscale 1.104.4 fixes SSH vulnerabilities in 1.104.2 and headscale 0.29.5 enabling root via forwarding; no real attacks reported.

Cyberdione Labs disclosed 11 Tailworm issues in Tailscale 1.104.2 and headscale 0.29.5. An authenticated peer with SSH forwarding can abuse Unix-socket forwarding to gain root, read /etc/shadow, or steal enrollment keys, enabling policy-limited lateral movement in lab tests. Fixes are in 1.104.4. No CVEs assigned; bulletins are TS-2026-014 to TS-2026-017. Tailscale is not advising to disable SSH but suggests the environment variable for mitigation.

Key facts
  • 11 Tailworm issues in Tailscale 1.104.2 and headscale 0.29.5
  • 6 high-severity, 4 in Tailscale SSH forwarding
  • Patches in 1.104.4; TS-2026-014 through TS-2026-017
  • No exploitation reported in the wild
  • Mitigation via TS_SSH_DISABLE_FORWARDING=1
  • Initial report October 23; fixes by October 28
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026Cyberdione Labs publishes Tailworm report on SSH flaws · The Hacker News
  2. Oct 26, 2026GBHackers details lab tests showing root access via SSH forwarding · GBHackers
  3. Oct 27, 2026BleepingComputer and SecurityWeek report 11 issues and patch timeline · BleepingComputer
  4. Oct 28, 2026The Hacker News reports release of 1.104.4 fixing the issues · The Hacker News
  5. Oct 28, 2026Help Net Security covers fixes and additional DoS concerns · Help Net Security

What each outlet adds

beyond the shared facts
  • GBHackersDetailed lab test scenarios for root via ssh -L and ssh -R
  • BleepingComputerCollective count of 11 issues and expected patch date
  • SecurityWeekHighlights six high-severity findings and fixes in public repos
  • The Hacker NewsAnnounces 1.104.4 release with specific bulletins and socket handling changes
  • Help Net SecurityMentions Conn25 flaw and denial-of-service issues
Vendors
Tailscale
Products
headscaleTailscale SSH
Organizations
Cyberdione Labs

Coverage

oldest first · one row per article · UTC
  1. · 6d ago GBHackersFirst report

    Tailscale SSH flaws can yield root on connected servers

    Lab tests on Tailscale 1.104.2 and headscale 0.29.5 showed root via privileged socket forwarding; no fixes yet.

  2. · 5d ago BleepingComputer

    Unpatched Tailscale SSH flaws can give authorized users root

    Cyberdione Labs detailed 11 Tailworm issues in Tailscale 1.104.2 and headscale v0.29.5; patches were expected October 27.

  3. · 5d ago SecurityWeek

    Tailscale prepares client fix after uncoordinated Tailworm disclosure

    Six high-severity findings in client 1.104.2 and headscale 0.29.5 can yield root via SSH forwarding; no exploitation is reported.

  4. · 4d ago Lobsters · security

    Tailscale investigating Tailscale SSH privilege-escalation flaws

    Authorized Tailscale SSH users may exceed their local-user permissions; a patched client is targeted for October 27.

  5. · 4d ago The Hacker News

    Tailscale 1.104.4 fixes SSH flaws reaching root-only sockets

    A policy-permitted SSH session could swap socket paths and reach Docker or the local API; no real attacks are reported.

  6. · 4d ago Help Net Security

    Tailscale patches SSH flaws enabling lateral movement inside tailnets

    Fixes shipped in Tailscale v1.104.4; abuse still requires a device the tailnet policy already allows to use SSH.