Overview
- Tailscale shipped client version 1.104.4, released Tuesday, October 27, which fixes the core SSH socket‑forwarding vulnerabilities and several related bugs.
- The flaws arose because the Tailscale SSH process performed Unix socket forwarding with root privileges, letting an approved session use timing tricks to reach root‑only sockets and perform elevated actions.
- Exploitation requires an attacker to first control a device the tailnet policy already permits to open Tailscale SSH, so the issue enables lateral movement inside allowed connections rather than unauthenticated access.
- The Tailworm report was published publicly before patches were widely available, the researcher shared proof‑of‑concept details only with Tailscale, and neither the company nor the researcher has so far reported in‑the‑wild exploitation.
- Tailscale urges immediate updates to v1.104.4, recommends disabling SSH forwarding where not needed by setting TS_SSH_DISABLE_FORWARDING=1, tightening SSH access rules, and revoking device identities on compromised hosts because reimaging does not revoke device keys.