Erica Windisch (Cyberdione Labs) published 11 findings against Tailscale 1.104.2 and headscale 0.29.5 with proof-of-concept kits and no vendor notice. The worst: SSH unix-socket forwarding runs as root, so a user or hacked device allowed to SSH to a node can get root on it and move to other servers. No patch and no CVE ids yet; Tailscale says a fix is coming.
What to do: Until a fix ships: limit Tailscale SSH rules to admins, turn off SSH forwarding where you can, and do not let shared or low-trust devices SSH to servers. headscale 0.29.5 cannot turn forwarding off. Oct 26 (THN): not unauthenticated RCE; it needs a compromised device already allowed to SSH; lab-tested, scope still under review. Oct 27: Tailscale confirmed the findings are real, calls them serious…
Researcher publishes 11 unpatched security flaws affecting Tailscale and headscale
A researcher just dropped a report on Tailscale SSH flaws: one compromised device could get root on others, and there is NO PATCH yet. Tailscale says a fix is coming.
Researchers report that a compromised, SSH-authorized device could gain root on permitted targets via forwarding flaws. Not unauthenticated RCE. Lab-tested; scope still under review.
‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real. Its new investigation page says most of what it found is privilege escalation and calls the issues “serious.” Fix targeted within 24 hours, no CVE or patched version out yet. Mitigate now: → Se
Tailscale warns of SSH flaws allowing root privilege escalation
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Why this score
Plan rubric with caps (verified sweep, Oct 25 PM): exploit kits public, no patch; 7 not 8 because it needs a device already allowed to SSH