Tailscale patches SSH flaws after researcher’s ‘Tailworm’ report
Tailscale says the researcher went public two hours after sending it the findings, and it is not recommending that every customer switch off its SSH feature
- Security bulletins: TS-2026-014 to TS-2026-017, all fixed in client 1.104.4
- Versions tested by Cyberdione Labs: Tailscale client 1.104.2 and headscale 0.29.5
- Serve and Funnel: five findings, three fixed as bugs; Tailscale says two work as designed
- Interim mitigation named by Tailscale: TS_SSH_DISABLE_FORWARDING=1, which turns off SSH forwarding only
- Customer base: close to 40,000 paid business customers, according to BetaKit in July 2026
Exposure sits with tailnets running Tailscale SSH on unpatched clients, most of all where access policies permit port forwarding, which could reach root-only sockets such as Docker’s. A separate Serve bug put nodes at risk of full takeover through the tailscaled local API where local users could write Serve configurations or backend paths. The researchers list some items as still open, including a memory-exhaustion issue in headscale and the relay client that is only partly fixed. Tailscale says a further flaw sits in an unreleased app connector feature and its stable app connectors are not affected.
“Instead, this would be better described as lateral movement limited to connections allowed by a tailnet policy file.”Mike Shaver, vice-president of engineering, Tailscale
Tailscale released client version 1.104.4 on 27 October, fixing flaws in Tailscale SSH and its Serve feature that a researcher had published three days earlier in a report listing 11 findings, six of them rated high severity.
The report, titled “Tailworm”, came from Erica Windisch of Cyberdione Labs. SecurityWeek described it as an “uncoordinated disclosure” and reported that it drew criticism on social media. In lab tests, Windisch’s team found that chained SSH flaws could spread automatically to every device a tailnet’s policy allowed, at under a second per hop, with no passwords or user interaction.
In a post on 28 October, Mike Shaver, vice-president of engineering at Toronto-based Tailscale since July 2026, said the SSH flaws let an authenticated session act beyond the privileges of its configured local user, including through SSH forwarding. He said exploitation needs an attacker who already has access to an authorized device, and that the flaws do not let an unauthenticated attacker connect to arbitrary servers. He disputed the worm label.
Tailscale recommends that customers using Tailscale SSH update to 1.104.4, limit SSH policies to the users and devices that need access and consider check mode, which adds an authentication step, for sensitive systems. Neither Tailscale nor the researchers report exploitation outside the lab.
Sources
- Tailscale, “Tailscale SSH: Findings and fixes”, blog post, 28 October 2026. https://tailscale.com/blog/tailscale-ssh-findings-fixes
- Tailscale, “Security bulletins” (TS-2026-014 to TS-2026-017), security bulletins, 26 October 2026. https://tailscale.com/security-bulletins
- Tailscale, “Tailscale SSH investigation update”, statement, 27 October 2026. https://tailscale.com/ssh-investigation-update
- Cyberdione Labs, “Tailworm”, research report, 24 October 2026. https://tailworm.com/
- SecurityWeek, “Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws”, news article, 27 October 2026. https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws/
- BetaKit, “Tailscale catches AI tailwinds as it nears 40,000 paid business customers”, news article, 21 July 2026. https://betakit.com/tailscale-catches-ai-tailwinds-as-it-nears-40000-paid-business-customers/
- Tailscale, “Welcome Mike Shaver”, blog post, 21 July 2026. https://tailscale.com/blog/welcome-mike-shaver
