Researchers published 11 Tailscale flaws before a fix shipped. The SSH ones reach root.
By Lior AharonovFounder, 7IT Solutions ·
What happened
Cyberdione Labs published 11 findings, named Tailworm, in Tailscale 1.104.2 and headscale 0.29.5, with details out before patches; six are rated high severity. Tailscale aimed to ship a patched client by the end of Tuesday 27 October, pending testing. Neither Tailscale nor the report mentions attacks in the wild.
Why it matters
Tailscale SSH runs as root. The researchers say one foothold device can reach any server its rules allow, and they call the SSH flaws wormable. Tailscale says most issues need an already authorized user.
What to do
Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and restart it, then narrow SSH rules to the users and devices that need them. Update the client once the patched build ships.
My take
Lior Aharonov
Founder, 7IT Solutions
When the researcher publishes first, the vendor's patch is a race, not a plan. Rotate access before you read the post-mortem.
Sources
Researched with AI tools; every fact is checked against the linked sources.