Tailworm Lists 11 Tailscale and headscale Findings; 7 Are Fixed in v1.104.4 and None Has a CVE
Security / news
Tailworm Lists 11 Tailscale and headscale Findings; 7 Are Fixed in v1.104.4 and None Has a CVE
An approved device with one SSH policy rule is enough to reach root through unix-socket forwarding, according to Cyberdione Labs. Tailscale says most SSH issues are privilege escalation by already-authorized users.
An authenticated user on a Tailscale network, holding one approved device and one SSH policy rule, can reach root through unix-socket forwarding in Tailscale SSH, according to a report by Cyberdione Labs that tests version 1.104.2. Tailscale tagged fixes in v1.104.4 on Oct. 27, 2026, and the report lists 7 of its 11 findings as fixed there.
None of the findings has a CVE ID or a CVSS score yet. The severities below are the researchers' own, and Tailscale had not published a technical write-up when its SSH investigation update went up on Oct. 26.
What an approved device can do
The report, published as Tailworm by Erica Windisch, founder of Cyberdione Labs, says the tailscaled SSH server runs as root and performs path checks and file operations on unix sockets without dropping privileges. Findings 1 to 3 cover ssh -L dialling as root, ssh -R replacing root-owned sockets, and a race that defeats the path allowlist. All three are rated High and fixed in v1.104.4. The report states that the allowlist of home, /tmp and /run/user "is not a security boundary."
On the hosted service, forwarding is granted per SSH rule. On self-hosted headscale v0.29.5 it is granted automatically, which widens who can reach it. The outcomes the report lists are root command execution, capture of enrollment keys and arbitrary deletion of root-owned files. It says the findings were verified on "unmodified, released software."
- Fixed in v1.104.47 findings
- Partial fix2 findings
- Open, no fix1 findings
- Documented, no change planned1 findings
Source: Tailworm report, mitigation matrix snapshot dated 2026-10-28
The four that are not fully closed
| Finding | Component | Report's rating | Status |
|---|---|---|---|
| 4 (C1) | conn25 app connector | High | Open pull request #22003 |
| 6 (C2 to C4) | headscale memory exhaustion, DERP client | Medium-High | Client fixed; headscale side pending |
| 9 (SERVE-F-3) | Funnel entitlement enforcement | Medium | Open, no fix |
| 10 (SERVE-F-4) | TS_SERVE_ALLOW_ALL_INTERFACES | Configuration note | No change planned |
Finding 4 concerns conn25, which the report calls "present but experimental in v1.104.2." A device granted the connector capability can steer traffic to a destination of its choosing, and network ACLs are not checked against the true destination. The report demonstrates LAN pivots on Oct. 24, and lists cloud metadata credential theft and access to Kubernetes cluster services as outcomes.
Finding 9 says the Funnel node attribute and funnel-ports capabilities "are enforced ONLY by the CLI." Finding 10 is a documented knob that, when set, "re-exposes the serve listener to the local network." Neither will change in v1.104.4.
What Tailscale says to do
Mike Shaver, Tailscale's VP of Engineering, said the company is not recommending that everyone disable Tailscale SSH. Tailscale's update says exploitation depends on what the connecting user or device has been granted, and that most of the SSH issues concern privilege escalation by someone already authorized.
The company's interim mitigation, which BleepingComputer also reported, is to set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it. That turns off forwarding without disabling Tailscale SSH. Tailscale also advises tightening SSH policies to the users and devices that need access.
The update names no affected or fixed versions and no count of findings; those come from the researchers' report. The two accounts do not conflict, but only one of them gives a version number to patch to.
The SSH server is not the only exposed piece. Finding 5 is an out-of-memory loop in root tailscaled from a session pin, and Finding 7 lets a remote peer reach the local admin API through tailscale serve --tcp, with a GET to /localapi/v0/status and a PATCH to /v0/prefs both returning 200 in the lab.
Operators on headscale should watch for the pending server-side fixes to Finding 6. Tailscale said it would publish a security advisory once fixes ship, followed by a technical blog post; neither was linked when this was written. The report cites bulletins TS-2026-014 through TS-2026-017 as Tailscale's own references.
For patching, the instruction is plain: move clients to v1.104.4 or later, and set TS_SSH_DISABLE_FORWARDING=1 on hosts that cannot be updated this week. For headscale, the open items are the memory-exhaustion fixes and the conn25 pull request. Teams building a patch list this week can add it to the GitLab CVSS 10.0 flaw and the PHP2Shell fixes, and note that the GitLab flaw carries a CVE ID, CVE-2026-110264, which no Tailworm finding does yet.
Sources
- 01Tailworm
More in Security
- 01A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 02Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 03Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 04KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.