Researcher Publishes 11 Unpatched Tailscale and Headscale Flaws; Tailscale Says It Is Fixing Issues

A security researcher has published details of 11 unpatched flaws in Tailscale and its open-source server alternative, headscale. The most serious let an attacker who already controls one device on a network reach root on other servers.

Erica Windisch of Cyberdione Labs released the report, titled Tailworm, today, Oct. 25. She tested Tailscale 1.104.2 and headscale 0.29.5 in a lab from Oct. 22 through Oct. 24.

As of publication, Tailscale had issued no security bulletin, no CVE identifier and no fixed version.

What the report describes

The SSH problem rests on how Tailscale SSH works. It does not check a user's password or key. It identifies the device, and an access rule decides whether that device may open an SSH session to a target.

The SSH server runs inside tailscaled, a background program with full root power. According to the report, when a user is allowed to forward Unix sockets (the local channels services like Docker use), the program opens or replaces those channels with root rights.

Windisch demonstrated three methods in the lab:

• Standard SSH port forwarding made the root-level process connect to a root-only system socket. The test gained root and read the /etc/shadow password file almost immediately.
• A root-owned socket was swapped for one the attacker controlled, allowing root command execution against certain services.
• A race condition between a file-path check and its use defeated a safeguard on which files forwarding can reach. That chain captured an enrollment key and joined the attacker's own machine to the network as a trusted server.

The third chain worked end to end only on networks without Tailnet Lock, according to the report.

Limits of the attack

Both conditions have to be met. Tailscale SSH must be configured to allow port forwarding, and the attacker must already control a device the access rules permit to connect to the target.

The report says that foothold can come from a vulnerable web application, a poisoned software package, phishing or stolen credentials. Tailscale does not create it. The report describes lab tests, not attacks on real networks.

Windisch calls the chain "wormable." She says that in the lab it moved from device to device in under a second per hop and needed no stolen passwords or keys. Some researchers dispute that label. The findings have not been independently reproduced, and the proof-of-concept code is not public.

In her testing, per-pair access rules, which limit exactly which source can reach which destination, stopped the spread. She calls them the one control that worked.

Other findings

The report's 11 findings fall into five groups: the SSH server, the serve and app connector features, the DERP relay client, and headscale.

In the experimental conn25 app connector, the report says a device with connector permission can send traffic to any destination it chooses. That includes the cloud metadata service that holds server credentials. In Kubernetes clusters, the same path could reach internal services.

The report also describes a headscale memory problem that needs no account. Windisch says a remote user can exhaust memory on the control server and block new devices from joining.

Tailscale's response and the disclosure dispute

Mike Shaver, Tailscale's vice president of engineering, answered publicly on Reddit. He wrote that the company had received the report and had already been examining the same areas with outside security specialists. He said it had found issues it is working to fix.

Shaver said Tailscale is still determining which setups are affected. He also said the company is "not recommending that everyone disable Tailscale SSH." SC Media reports that Tailscale advises users to review access rules and consider SSH check mode.

Windisch says she sent her findings and a proof of concept to Tailscale's security contact before going public. She did not wait out a coordinated-disclosure window, the convention that gives a vendor weeks or months to ship a fix first.

Reaction on X split quickly, according to Startup Fortune. Some researchers called the release reckless, arguing it hands attackers a map with no patch to defend against. Others saw a researcher forcing a vendor's hand after what she felt was an inadequate response window.

Tailscale has not confirmed the report's specific technical claims.

What administrators can do now

The options depend on where the network runs. On Tailscale's hosted service, port forwarding can be switched off per SSH rule.

On headscale 0.29.5, forwarding cannot be turned off at all. The report says every SSH grant on that version should be treated as giving root on the target.

Narrowing access rules to specific source-to-destination pairs is the mitigation the report singles out for any deployment.

Tailscale has not said when fixes will ship or which configurations are affected. Shaver's statement that the company is still working that out is the open question for anyone running Tailscale SSH with forwarding enabled.