GoKawiilTailscale faces 11 unpatched flaws in VPN software and Headscale server
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaws affect how Tailscale's SSH server handles privileged file operations, exploitation could let an already-authorized but lower-trust device escalate to root control over other machines on a tailnet, undermining the zero-trust model the VPN is built on. Public disclosure before patches exist raises the risk that attackers could exploit these bugs faster than organizations can respond, though Windisch argues awareness will accelerate remediation. The scope spanning both the commercial product and the self-hosted headscale server suggests the issue could affect a wide range of deployments.
- Cyberdione Labs found 11 unpatched vulnerabilities, named Tailworm, in Tailscale and headscale.
- The most critical bug allows root-level code execution via Tailscale SSH's unix-socket forwarding.
- The flaws were publicly disclosed before patches were available, intended by researchers to speed fixes.
Source: bleepingcomputer.com, 2026-10-27
Published there as: “Tailscale warns of SSH flaws allowing root privilege escalation”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.