AW Dev Rethought Flash: Tailworm — 11 Unpatched Tailscale Flaws and No Fix Yet

There is no patch. Start there, because it changes how you read everything else.

On 25 October, Erica Windisch of Cyberdione Labs published 11 security flaws in Tailscale v1.104.2 and headscale v0.29.5. The findings were reproduced in a lab against unmodified releases between 22 and 24 October, then released publicly without coordinated disclosure.

There are no CVE IDs. Tailscale’s security bulletins carry no entry for any of this — the most recent is TS-2026-013, covering the eMudhra distrust. A Tailscale engineer confirmed on Hacker News that the team is working on it and that more detail will follow. That is the entire vendor response so far.

The researcher named the cluster Tailworm, and that name is doing real work.

The SSH Forwarding Flaw

The headline finding concerns Tailscale SSH. According to the researcher, when Tailscale SSH is enabled, unix-socket port forwarding runs as root.

A user holding one approved device and an SSH rule for a target node can obtain root on that target. On its own that is already a serious privilege escalation — it means your ACL policy is not the thing deciding what a principal gets. If you deliberately restricted someone to a non-privileged account on that host, that restriction was declared but not enforced.

The second half is what elevates it. The researcher reports that the same access allows capture of enrollment keys from the compromised host.

Why It Is Called Tailworm

Enrollment keys are what let a machine join a tailnet. If you can reach root on a node and lift its enrollment material, you are no longer bounded by the ACL rule you started with. You can enroll as something new, carrying whatever access that identity has, and do it again from there.

One compromised laptop becomes root on a server. That server yields credentials to the mesh. Those credentials reach the next server. Each hop expands what the next hop can touch.

That is a propagation path rather than a single escalation, and propagation paths are what turn an incident into an outage.

The Other Findings

The SSH issue is the most severe but not the only one. Three further categories were disclosed.

Experimental app connectors can bypass ACL policy. Per the report this includes reaching cloud metadata endpoints and internal LAN addresses — the two destinations you least want a bypass pointed at. Cloud metadata services are a well-worn route to instance credentials, and internal LAN reachability defeats the point of segmenting what a tailnet member can touch.

A tailscale serve forward can expose the local API, which is the control surface for the daemon on that machine.

headscale and DERP are both vulnerable to memory exhaustion. These are availability issues rather than access ones, but headscale is the self-hosted control plane for a lot of deployments and DERP relays traffic when a direct connection cannot be established.

Full technical detail on all 11 has not been published in one place, and the upstream report dates are not documented.

How Bad Is It, Honestly

The researcher rates this High. Tailscale has not confirmed that rating, and the distinction matters for how you triage tonight.

This is lateral movement from an existing foothold, not internet-facing remote code execution. Nobody is scanning the internet and taking your tailnet. An attacker needs one approved device on your tailnet and an SSH rule before any of it begins.

That caveat should lower your panic without lowering your priority. The entire argument for a zero-trust mesh is that one compromised endpoint should not become access to everything behind it. Device compromise is the threat model Tailscale exists to contain — a phished laptop, a stolen session, a contractor’s machine with something on it. A flaw that converts precisely that event into root across your fleet is attacking the product’s central promise, not a peripheral feature.

So: not an emergency in the patch-before-you-sleep sense, because there is nothing to patch. An emergency in the sense that your blast radius is considerably larger than your architecture diagram claims.

Published Without Coordination

The researcher states the issues were reported upstream but that the release was not coordinated with Tailscale.

That leaves operators in the worst available configuration: the flaws are public, reproducible, and described well enough to act on, while the vendor has shipped nothing. Whatever one makes of the ethics, the practical position is that defenders and attackers received this information at the same moment, and only one of those groups needs the vendor’s cooperation to proceed.

It also means you cannot wait for a version number. The normal workflow — read advisory, check version, bump, move on — does not apply. There is no fixed release to bump to. Configuration is your only lever.

What To Do Right Now

The researcher’s recommended mitigation is to disable Tailscale SSH and App Connectors. With no patch available, that is the action rather than one option among several.

Practically: audit where Tailscale SSH is actually enabled, which in most tailnets is broader than people remember, because it is convenient, it gets switched on per node, and then it is forgotten. Check your ACL policy for SSH rules and treat every node covered by one as currently reachable at root by anyone those rules admit. If you run app connectors, they are experimental, and the ACL bypass means they are not enforcing what your policy says they do.

If you self-host headscale, you also carry the memory exhaustion exposure on your control plane, which is a different kind of bad day.

Then watch Tailscale’s security bulletins directly rather than waiting for the news cycle. That page is where a real fix and real version numbers will appear, and right now it is the only authoritative source — everything else, including this post, is working from one researcher’s unverified report.

The uncomfortable summary: the thing currently standing between one compromised device and your whole fleet is whether you have turned a feature off.