Tailscale says its security and engineering teams, aided by outside specialists, have found multiple vulnerabilities in Tailscale SSH, most involving privilege escalation that could let an already-authorized user act beyond their configured permissions. The company has fixed most issues and is targeting a patched client release by the end of Tuesday, October 27, while continuing to assess remaining findings.
tailscale.com
· 2026-10-27
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
bleepingcomputer.com
· 2026-10-27
GoKawiil