Cliente Tailscale · Disclosed

Tailscale Fixes Tailworm in Client 1.104.4; headscale Still Unpatched

Oct 24, 2026 · 3 min read

The 11 Tailworm flaws, disclosed without coordination by researcher Erica Windisch of Cyberdione Labs, affect the Tailscale client 1.104.2 and headscale 0.29.5; in lab tests, one already compromised device reached root on other servers allowed by the SSH policy, with no passwords and in under a second per hop. Tailscale fixed the client in version 1.104.4, with bulletins TS-2026-014 through TS-2026-017; headscale remains unpatched and the experimental conn25 connector has a fix only in an open pull request. Update the client, deny SSH forwarding in the rules, and treat every headscale SSH grant as root-equivalent.

By HIFY Radar newsroom Updated 10/28/2026 08:52 PM Get this every day →← Back to the feed 11 sources

HighVulnerabilityDisclosedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researcher Erica Windisch of Cyberdione Labs disclosed the 11 flaws dubbed Tailworm without coordination, affecting the Tailscale client 1.104.2 and the headscale 0.29.5 server. In lab tests, a single already compromised device gained administrator (root) access on other servers allowed by policy, with no passwords and no user interaction. Tailscale has shipped the fixed client 1.104.4, with four security bulletins.

Why it matters

For teams using Tailscale SSH, one ordinary entry point, such as phishing or a malicious software package, can turn into administrator access across the server fleet within minutes, per the researcher's tests. Headscale, the self-hosted server, remains unpatched against a denial-of-service flaw that requires no login and can block new device onboarding organization-wide. No real-world exploitation has been reported so far, by either Tailscale or the report.

What to do

Update the Tailscale client to 1.104.4 or newer on every device. Deny SSH forwarding in the access rules and review who has SSH to what; until headscale is fixed, treat every headscale SSH grant as root-equivalent. On internet-exposed headscale, apply memory limits, restart supervision and rate limiting.

For the technical team

Affected: Cliente Tailscale (tailscaled, Tailscale SSH, serve, app connectors, cliente DERP) e headscale · Tailscale 1.104.2 (tested; released 21 October 2026) and headscale 0.29.5 (tested). Components: tailscaled, embedded SSH server, serve/funnel, DERP client and the conn25 app connector (pre-production, unreleased).
Exploitation: No in-the-wild exploitation reported by Tailscale or the report. Automated spread demonstrated in the researcher's lab: under a second per hop, no passwords, stolen keys or user interaction, reaching every device the policy permits; bounded by per-pair SSH grants and hardware-bound device credentials (TPM/Secure Enclave). Tailscale describes the pattern as lateral movement within policy, not a self-replicating worm. No CVEs in the bulletins.
Fix: Tailscale client 1.104.4 fixes SSH (TS-2026-014, TS-2026-015) and serve (TS-2026-016, TS-2026-017); tagged 27 October 2026 and published on GitHub 28 October at 01:05 UTC, per Brandefense. Mitigation before updating: TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and service restart; per-pair SSH grants, never identity-wide or tag-wide accept rules. headscale: unpatched (0.29.6 release notes do not mention it, per Brandefense); use memory limits, restart supervision and rate limiting. conn25: fix in an open pull request. DERP client: fixed in 1.104.4 per the researchers, with no Tailscale bulletin.
Vector: Five classes. (1) Tailscale SSH runs as root and performs Unix-socket forwarding (ssh -R/-L) with path checks as root; races and missing privilege drop let an ordinary session replace, dial or delete privileged resources; requires one approved device and one SSH policy rule granting forwarding (automatic on headscale, per-rule on SaaS). (2) Experimental conn25 app connector forwards traffic to attacker-chosen destinations with no validation and never consults network ACLs; requires a device granted the connector capability. (3) Self-hosted headscale: unauthenticated memory exhaustion; requires only internet reachability, no account. (4) DERP client: unbounded read of a hostile relay's response. (5) serve: TCP forward to a Unix socket lacks the guard present on the HTTP path, plus a race in per-mount authorization.
More details: Uncoordinated disclosure; report reached Hacker News on 25 October 2026, testing window 22 to 24 October on unmodified software. Author: Erica Windisch, Cyberdione Labs. Mike Shaver, Tailscale VP of Engineering, confirmed on Reddit that most issues concern Unix privilege and SSH forwarding handling after authorization. Tailscale says the stable app connectors are not affected, only pre-production conn25, and that two serve/funnel findings work as designed. On headscale 0.29.5 forwarding cannot be disabled: it is granted unconditionally on every accepted session.

Timeline

10/28/2026 08:52 PM
Tailscale published official security bulletins: Tailscale SSH Unix-socket forwarding (TS-2026-014) let authenticated peers with forwarding access reach root-only sockets, including Docker's and the Tailscale local API; separate fixes cover SSH session memory exhaustion (TS-2026-015). The company st
10/28/2026 04:16 AM
Tailscale shipped client 1.104.4 fixing the Tailscale SSH connection-forwarding flaws, which run with root privileges.
10/28/2026 03:26 AM
Tailscale shipped a fix for the Tailworm SSH flaws in its client; headscale remains unpatched.

Want the next updates in your inbox? Get the daily edition →

See all 10 updates

10/27/2026 12:29 PM
Details of the flaws, now dubbed 'Tailworm', went public in an uncoordinated disclosure before any fix; Tailscale says it is preparing patches.
10/27/2026 09:44 AM
Tailscale acknowledges 'serious security issues' and confirms that a user admitted on an ordinary account may gain elevated privileges; the patch was due later the same day.
10/27/2026 03:06 AM
Tailscale confirms the SSH flaws are real and calls them serious, mostly privilege escalation; a fix is targeted within 24 hours, with temporary mitigation via TS_SSH_DISABLE_FORWARDING=1 and tighter SSH access rules.
10/26/2026 02:44 PM
Community analysis clarifies the flaws require prior authorized SSH access or an already compromised trusted device, not unauthenticated attackers; setups using Tailscale only with one's own devices would be unaffected.
10/26/2026 02:41 PM
Researcher Erica Windisch published the 11 flaws without coordinated disclosure; Tailscale SSH race conditions let an already compromised device gain root on other servers and register a rogue node in the network.
10/26/2026 02:31 PM
Lab tests described by a researcher show SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices; Tailscale says a fix is coming.
10/26/2026 01:11 PM
Incident opened.