Tailworm: Tailscale SSH Bugs Can Turn One Login Into Root
Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27.
Researchers at Cyberdione Labs say a single compromised device on a Tailscale or headscale network can be used to gain root on other servers, through how Tailscale’s built-in SSH server handles forwarding. Their report, Tailworm, lists 11 findings in Tailscale client v1.104.2 and headscale v0.29.5. Tailscale doesn’t dispute them. In an Oct. 26 update, it calls most of them “serious security issues” and says it’s aiming to ship a patched client by the end of Oct. 27, pending testing.
For defenders
The main flaw: Tailscale SSH runs as root and does its Unix-socket forwarding checks (ssh -L / ssh -R) with root privileges. The researchers say they can beat its path allowlist with a race condition, so an SSH user who’s allowed to forward can reach root-only sockets. In their lab that meant the container daemon, systemd’s D-Bus and the local Tailscale API. That’s T1068 (Exploitation for Privilege Escalation). Other findings, using the researchers’ own ratings: the experimental conn25 connector lets an entitled user reach arbitrary destinations such as cloud metadata (High), the root SSH daemon can be made to exhaust its memory (High), headscale has an unauthenticated memory-exhaustion bug (Medium-High), and serve --tcp can forward to the local control socket (High).
Status: No CVE IDs or CVSS scores have been assigned. The report describes lab demonstrations only, with no exploitation in the wild. Fixes are merged into the tailscale and gliderssh main branches but weren’t in a numbered release as of the report. The researchers say headscale can’t turn off forwarding, so any SSH grant there should be treated as root-equivalent.
Mitigation now: Tailscale says to set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it. It also recommends narrowing SSH policies to the users and devices that need them. The researchers add: replace tag-wide SSH rules with per-pair grants, remove serve TCP forwards that point at Unix sockets, and enforce egress allowlists on connectors. After a root compromise, delete the device at the control plane, because reimaging alone doesn’t revoke copied keys.
What it means for you
Tailscale is a popular tool for joining your computers into a private network. If you only use it for remote access and haven’t turned on “Tailscale SSH,” the main bug doesn’t apply to you, but install the next update when it arrives anyway. If you do use Tailscale SSH, anyone allowed to SSH into a machine might be able to take it over completely, so limit who has that access until the patch lands.
Do this now
- If you use Tailscale SSH, set
TS_SSH_DISABLE_FORWARDING=1fortailscaledand restart it. - Review your SSH access rules and remove broad “everyone in this group can SSH everywhere” grants.
- Update every Tailscale client as soon as the patched release ships, and watch Tailscale’s update page for the advisory.
- Self-hosting headscale? Put memory limits and rate limiting on it, and keep it off the open internet where you can.