Overview
- Security firm Cyberdione Labs published the Tailworm report that found 11 vulnerabilities in Tailscale 1.104.2 and headscale v0.29.5, with four flaws focused on the product’s embedded SSH.
- The researchers showed in lab tests that Unix‑socket forwarding in Tailscale’s SSH can be abused by an authorized device to run code as root and to steal enrollment keys that allow adding rogue devices.
- Those lab demonstrations also included a wormable scenario that moved automatically between hosts allowed by policy, with researchers saying propagation took under a second per hop.
- Tailscale acknowledged the findings, posted code fixes to public repositories, and said it was testing a patched client targeted for release on Tuesday while advising users to tighten SSH policies and disable SSH forwarding if not needed.
- Organizations should prepare to install the official patched client when released, review which users and devices have SSH access, and expect a technical advisory and blog post from Tailscale explaining the fixes and affected configurations.