Tailworm: Tailscale 1.104.4 patches SSH socket-forwarding flaws; headscale 0.29.5 reportedly still unfixed

Linha do tempo

1. thehackernews.com ↗ · pub. 28/10/2026 03:20 · coletado 28/10 06:00

   Tailscale patches SSH socket-forwarding flaws (Tailworm) allowing root-level socket access from a compromised device

   ler a análise desta fonte ocultar

   Tailscale released version 1.104.4 to fix flaws in its built-in Tailscale SSH server that let an attacker with a foothold on a policy-trusted device reach root-only sockets on other servers. The issues were disclosed in a report dubbed Tailworm, published by Erica Windisch of Cyberdione Labs about 2 hours before Tailscale received it, so the disclosure was uncoordinated. The fix covers four bulletins (TS-2026-014 to TS-2026-017), none of which has a CVE or severity score yet. Neither Tailscale nor the report claims in-the-wild exploitation, and the proof-of-concept code is not public. Tailscale disputes Windisch's "wormable" characterization and describes the issue as lateral movement limited to connections the policy file already allows. The self-hosted headscale control server is reportedly worse off: its newest release, 0.29.5, does not fix the reported issues.

   Technical Details

   • TS-2026-014: In Tailscale SSH socket forwarding, the tailscaled process, running as root, checked the Unix socket path and then operated on it. A timing trick (TOCTOU) let an attacker swap the path after the check. In Windisch's lab tests, forwarding to the Docker control socket gave a root shell and read of /etc/shadow. Tailscale's bulletin more narrowly cites root-only sockets such as the Docker socket or the tailscaled local API.
   • TS-2026-015: A permitted SSH session could exhaust server memory and crash the Tailscale process, cutting all Tailscale networking on that node.
   • TS-2026-016: In tailscale serve, a forward to a Unix socket could reach the tailscaled local API, giving remote control of the node, plus a related socket-swap issue.
   • TS-2026-017: With TLS serve and 2 or more mounts, one request could receive another mount's permission headers.
   • Preconditions: the attacker must control a device that the policy permits to open an SSH session to the target, with forwarding allowed in the rule. Tailscale says unauthenticated attackers cannot connect to arbitrary servers. The SSH server runs only on Linux and the open-source macOS build; the attacker's device can be any platform.
   • Windisch reports that on headscale, SSH forwarding is granted on every accepted session and cannot be disabled in policy, so every SSH grant should be treated as root. She also says one compromised device could spread to every device the policy allowed in under a second per step.
   • Tailscale says the app-connector finding concerns the unreleased experimental feature conn25. Of 5 serve and funnel findings, it fixed 3 and said the other 2 work as designed.
   • This follows a June 2026 fix in version 1.98.9 for a separate Unix-socket forwarding flaw in Tailscale SSH.

   Remediation

   • Update to Tailscale 1.104.4 or later. 1.104.4 performs forwarding as the logged-in user instead of root and relies on operating system file permissions instead of the earlier path check.
   • If a server cannot be updated, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This disables forwarding without disabling Tailscale SSH and blocks several of the more serious findings.
   • Review SSH access rules so only necessary users and devices have access. Windisch's tests found that single device-to-device rules held back the spread, and that binding device keys to hardware such as a TPM prevented reuse of a stolen identity.
   • SSH check mode does not stop these forwarding flaws, because forwarding happens inside an already approved session.
   • For possibly compromised servers, a stolen device key stays valid until the device is deleted at the control plane, and reimaging does not revoke it. Tailscale's notices do not cover this case.
2. securityweek.com ↗ · pub. 27/10/2026 12:26 · coletado 27/10 13:00

   Tailscale prepares patches for 'Tailworm' flaws in Tailscale SSH and headscale after uncoordinated disclosure

   ler a análise desta fonte ocultar

   Cyberdione Labs published a report on Tailworm, 11 findings in the Tailscale client (version 1.104.2) and the self-hosted control server headscale (version 0.29.5). It was released before any patches existed. Six findings are rated high severity, and four of them affect Tailscale SSH. Researchers describe these as wormable privilege escalation flaws that can give root on reachable servers. Tailscale says fixes are largely in place and aimed to ship a patched client by the end of 27 October 2026, pending testing. Neither Tailscale nor the report mentions in-the-wild exploitation.

   Technical Details

   • Tailscale SSH performs some forwarding operations with root privileges, and the safeguards meant to restrict them can be bypassed.
   • An attacker who controls one device can target any server that device may reach over Tailscale SSH, provided the access rule allows forwarding. Lab tests gave root on target servers and theft of keys that can enroll rogue devices.
   • The initial foothold could come from phishing, a vulnerable web application or a malicious software package.
   • The SSH flaws are wormable. An automated chain moved across all SSH-permitted servers in under a second per hop, with no user interaction and no user credentials involved.
   • Other findings affect the experimental app connector feature, the Serve feature, headscale and the client's relay component. They could allow access to cloud metadata services and internal networks while bypassing access rules, exposure of a node's administrative interface to remote peers, or denial of service.
   • Tailscale VP of Engineering Mike Shaver said most issues concern post-authorization handling of Unix privileges and SSH forwarding. He said this is not the same as an unauthenticated attacker connecting to arbitrary machines, and that impact depends on how SSH access is configured.
   • Fixes for several findings have landed in Tailscale's public repositories but not yet in a numbered release.

   Remediation

   • Apply the patched Tailscale client once released. A security advisory and technical write-up are to follow.
   • Until then, review SSH access policies and disable SSH forwarding where it is not needed, which mitigates several of the more serious findings.
   • Tailscale does not recommend disabling Tailscale SSH entirely, based on its current assessment.
3. bleepingcomputer.com ↗ · pub. 27/10/2026 11:09 · coletado 27/10 12:00

   Tailscale discloses 11 unpatched 'Tailworm' flaws in Tailscale SSH and headscale enabling root privilege escalation

   ler a análise desta fonte ocultar

   Tailscale is preparing patches for 11 vulnerabilities, collectively named Tailworm, that were reported and publicly disclosed by Cyberdione Labs before fixes were available. The flaws could allow credential theft, server crashes and privilege escalation to root. They were found during an audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. The most severe issue is in the Tailscale SSH server, where an already authorized user could gain root code execution through Unix-socket forwarding. Tailscale called the issues "serious" and aimed to release a patched client by the end of October 27, but does not recommend disabling Tailscale SSH. The article does not report in-the-wild exploitation.

   Technical Details

   • Researchers say all findings were reproduced in a lab on unmodified, released software (tailscale v1.104.2, headscale v0.29.5).
   • Most Tailscale SSH issues are privilege escalation: a user authorized to connect over Tailscale SSH may exceed the permissions of their configured local user.
   • The most critical flaw abuses Unix-socket forwarding in the Tailscale SSH server to obtain root code execution on a targeted tailnet.
   • Exploitability depends on the permissions granted to the connecting user or device, system configuration and other conditions. Tailscale is still verifying the full scope and the affected configurations.
   • No CVE identifiers are given in the article.

   Remediation

   • Apply the patched Tailscale client as soon as it is released (targeted for the end of Oct 27).
   • Review Tailscale SSH access policies and limit access to the users and devices that need it.
   • If SSH forwarding is not needed, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This mitigates several of the more serious findings without disabling Tailscale SSH.
   • Consider temporarily tightening access to sensitive systems while the investigation continues.
4. gbhackers.com ↗ · pub. 26/10/2026 02:09 · coletado 26/10 03:00

   Tailworm: Tailscale SSH and Headscale flaws allow root access, lateral movement and DoS; no CVEs or fixes yet

   ler a análise desta fonte ocultar

   Erica Windisch of Cyberdione Labs published the Tailworm research report, disclosing multiple high-severity vulnerabilities in Tailscale (1.104.2) and Headscale (0.29.5). The testing ran from October 22 to 24, 2026. Abused through Tailscale SSH, the flaws could let an attacker who controls one device gain root on other reachable servers, bypass network policies, steal credentials and disrupt remote-access infrastructure. The results were reproduced only in lab environments. As of October 25, no CVE identifiers or fixed versions exist, and Tailscale has acknowledged the report and is investigating.

   Technical Details

   • T3 (local forwarding, ssh -L): the privileged tailscaled process performs Unix-domain socket forwarding as root, so an authenticated peer can reach root-restricted sockets. Researchers used it to talk to a privileged Docker socket, run commands as root and read /etc/shadow.
   • T2 (remote forwarding, ssh -R): the privileged process can be made to replace root-owned Unix sockets with attacker-controlled listeners. This could enable command execution, service impersonation and interception of Docker registry credentials.
   • A related TOCTOU race condition bypasses file-path restrictions that protect sensitive system resources.
   • Lateral movement: trusted device identities and permissive SSH rules allow automated propagation between machines, in under one second per hop in the lab.
   • The experimental conn25 app connector may let authorized devices reach unintended internal services, cloud metadata endpoints and Kubernetes resources.
   • Memory-exhaustion flaws in Headscale and Tailscale components could disrupt device registration and network availability.
   • The attacks depend on existing SSH access permissions and port-forwarding capabilities.

   Remediation

   • Review Tailscale SSH permissions, restrict connections to specific source and destination devices, and disable unnecessary port forwarding.
   • Headscale 0.29.5 cannot disable SSH forwarding independently, which adds exposure.
   • Limit app connector permissions, enforce destination allowlists, monitor suspicious device enrollments and protect device credentials with hardware-backed security.
   • Track vendor channels for patches and CVE assignments.
5. thehackernews.com ↗ · pub. 25/10/2026 14:44 · coletado 25/10 16:00 primeiro registro

   Unpatched Tailscale SSH flaws (Tailworm) let one compromised device gain root on reachable servers in lab tests

   ler a análise desta fonte ocultar

   Security researcher Erica Windisch of Cyberdione Labs published the Tailworm report on October 25, describing 11 findings in Tailscale and headscale. The most serious is a privilege escalation in Tailscale SSH: an attacker who already controls one device permitted by the network's access rules can reach root on other servers when SSH port forwarding is allowed. As of publication, Tailscale had issued no security bulletin, no CVE and no fixed version. Tailscale's VP of engineering, Mike Shaver, said on Reddit that the company is fixing issues it found and is still working out which setups are affected. He did not recommend disabling Tailscale SSH across the board. All findings rest on Windisch's lab testing alone. They have not been independently reproduced or confirmed by Tailscale, and the proof-of-concept code is not public.

   Technical Details

   • Tested versions: Tailscale 1.104.2 and headscale 0.29.5, in a lab over three days. No real networks were attacked.
   • Prerequisites: Tailscale SSH configured to allow port forwarding, and an existing foothold on a device the access rules permit to connect to the target. The report lists the foothold routes as a vulnerable web application, a poisoned package, phishing or stolen credentials. No passwords or keys are needed, because Tailscale SSH authorizes by device identity.
   • Method 1: standard SSH port forwarding made the root-level Tailscale process connect to a root-only system socket, yielding root and read access to the system password file.
   • Method 2: replacing a root-owned socket with an attacker-controlled one allowed root command execution against certain services.
   • Method 3: a time-of-check/time-of-use race defeated the safety check on forwardable file paths. In the lab this captured a device-enrollment key and used it to join an attacker's machine to the network as a trusted server. The full chain worked only where Tailnet Lock was not enabled. With Tailnet Lock on, secrets were captured but the final step was not completed.
   • Windisch calls the result "wormable": in the lab, spread to every device the rules allow took under a second per step. Other researchers have publicly questioned the "wormable" label, while others call the root-access finding serious.
   • Spread was limited by access rules written as single source-to-destination pairs and by device keys bound to hardware such as a TPM or Secure Enclave.
   • On headscale 0.29.5, forwarding cannot be disabled, so every SSH grant should be treated as root on the target.
   • Other findings cover app connectors, the serve feature, the DERP relay and headscale. The experimental conn25 app connector lets a permitted user send traffic to unapproved destinations, including a cloud metadata service that can expose server credentials.
   • Disclosure is disputed: it was described as "reported but not coordinated". Windisch says she sent the report and PoC to Tailscale's security contact the Saturday before publication.
   • Earlier in 2026 Tailscale fixed related SSH and socket-handling flaws, including SSH Unix socket forwarding reaching a privileged socket, in version 1.98.9.

   Remediation

   No patch is available, so mitigation is configuration-based:

   • Write SSH rules as single source-to-destination pairs and remove broad identity- or tag-based grants.
   • Disable SSH port forwarding where possible. This is a per-rule setting on the hosted service and impossible on headscale 0.29.5.
   • Remove app connector permissions from devices that do not need them.
   • Remove any tailscale serve forward pointing at a Unix socket.
   • Enable node-key expiry and Tailnet Lock.
   • Delete compromised devices at the control plane, because reimaging does not revoke copied keys.
   • Enable automatic updates and SSH check mode. Check mode only adds a barrier and does not fix the escalation.