Overview
- Security researchers at Cyberdione Labs published the Tailworm report describing 11 flaws in Tailscale and headscale that include multiple privilege-escalation bugs in Tailscale’s embedded SSH.
- The report showed that certain SSH forwarding and Unix-socket handling errors let an authorized session operate as root and that researchers could chain those bugs to move across allowed systems without credentials.
- Tailscale says its engineers have implemented fixes for most findings and were completing tests to ship a patched client targeted for the October 27 release window.
- Until updates are applied, Tailscale recommends reviewing SSH access policies, disabling SSH forwarding if not needed by setting TS_SSH_DISABLE_FORWARDING=1, and restricting access to sensitive systems.
- The disclosure was uncoordinated when published over the weekend before October 27, prompting debate about timing, and neither Tailscale nor the researchers have reported confirmed in-the-wild exploitation so far.