Tailworm: Tailscale SSH Flaws Could Let One Hacked Device Reach Root on Other Servers

A single hacked device on a Tailscale network may be enough to gain root access to other servers it can reach, according to a report titled Tailworm, published on October 25 by Erica Windisch of Cyberdione Labs.

The attack needs two things: Tailscale SSH configured to allow port forwarding, and an attacker who already controls one device that the access rules permit to connect to the target. Tailscale does not create that first foothold — attackers get it the usual ways: a vulnerable web app, a poisoned package, phishing, or stolen credentials.

Why it works

Tailscale SSH is not a normal SSH server. Instead of checking a password or key, it identifies the device, and a single access rule decides whether that device may open a session to a target. As a result, the attack needs no stolen passwords or keys.

In the lab, Windisch tested Tailscale version 1.104.2 and headscale 0.29.5 over three days, demonstrating the problem in stages. An ordinary SSH session with port forwarding made the root-level Tailscale process connect to a system socket only root should reach — and the test gained root and read the system password file almost immediately. A second method replaced a root-owned socket with the attacker's. A third defeated a safety check by racing the system between when it checks a file path and when it uses it; that chain captured a key used to enroll new devices and joined the attacker's own machine to the network as a trusted server.

That final step worked end to end only where Tailscale's Tailnet Lock feature was not enabled. Windisch calls the result "wormable": in the lab, one device spread to every machine the rules allowed in under a second per step. Some researchers dispute that label; others call the root-access finding serious.

Response and a contested disclosure

As of publication, Tailscale had issued no security bulletin, no CVE, and no fixed version. VP of engineering Mike Shaver wrote on Reddit that the company had received the report, had already been looking at the same areas with outside specialists, and is working on fixes — but is "not recommending that everyone disable Tailscale SSH."

Windisch described the disclosure as "reported but not coordinated." She did not publish the proof-of-concept code, providing it only to Tailscale's security contact a few days before the public post. The SSH issue is one of 11 findings; Windisch herself suggests the app connector finding may be more impactful for some organizations.

What to do now

With no patch, only configuration changes remain. The report and Tailscale's own advice largely overlap: write access rules as single source-to-destination pairs, turn off port forwarding where possible (on headscale 0.29.5 it cannot be disabled, so treat every SSH grant there as giving root), remove unneeded app connector permissions, enable node-key expiry, and delete a compromised device at the control plane — since reimaging does not revoke keys an attacker may already have copied.

Source: The Hacker News