Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device

A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network.

The report, called Tailworm, was published on October 25, 2026, by security researcher Erica Windisch of Cyberdione Labs. Tailscale has not confirmed the findings, and as of the report date, it had published no bulletin, CVE number, or fixed version for them.

Tailscale SSH Flaws

The report lists 11 findings in five groups. They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks. The researcher tested tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026.

The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root power on the machine. According to the report, when a user has permission to forward Unix sockets, which are local channels used by services such as Docker, the program opens or replaces those channels using root rights. In the lab, an ordinary SSH session gained root and read the /etc/shadow password file almost instantly.

The researcher also describes a chain that spreads across a network. In the lab, one hacked device reached root on other servers and enrolled a rogue node that looked like a trusted server. The report says this spread needed no passwords or stolen keys, and it moved from device to device in under a second per hop.

Tailscale builds a private mesh network in which devices trust each other based on policy rules. According to the report, every device receives a full list of its peers, so a hacker on one machine can see every possible target. The researcher says the first foothold can come from a vulnerable web app, a poisoned software package, a phishing implant, or stolen login details.

This matters because the policy assumes that trusted devices are safe. The report says Tailscale does not create the first foothold, but it can turn one small breach into wide access across a fleet. Per-pair access rules stopped the spread in the lab, and the researcher calls them the single control that worked.

Threat groups have already used Tailscale to move across networks. A Scattered Spider threat actor profile describes how the group used Tailscale VPN to move across environments.

Beyond SSH, the report describes problems in the experimental conn25 app connector feature. According to the researcher, a device with connector permission can send traffic to any destination it picks, including the cloud metadata service that holds server credentials. In Kubernetes clusters, the same path could reach internal services.

The report also describes a headscale memory problem that needs no account. The researcher says a remote user can exhaust memory on the control server, which can block new devices from joining. A serve feature can also expose the local admin interface to remote peers when it forwards traffic to a Unix socket.

A Pattern of Recent SSH Fixes

This is not the first serious Tailscale SSH issue this year. In July 2026, Tailscale fixed TS-2026-009, where a username beginning with a dash could make a Linux account lookup return the root account. That let a user with SSH access open a root session in violation of ACL rules. The fix arrived in version 1.98.9.

Root access through SSH is also a wider Linux problem. A Linux privilege escalation report shows how an SSH user with a low-level foothold can reach root on major distributions.

The researcher also argues that the open-source design moved away from layered protection. The report says Tailscale SSH replaces OpenSSH, which splits privileges so that user sessions run with the user’s rights. The researcher says OpenSSH drops privileges before a session starts, while the Tailscale path keeps a highly privileged process in charge.

No official patch exists yet, so administrators should follow the researcher’s interim steps and Tailscale’s documentation. Replace broad identity-wide or tag-wide SSH rules with per-pair grants that name one source and one destination. Set forwarding to denied in each rule where that setting exists. On headscale 0.29.5, forwarding cannot be turned off, so every SSH grant should be treated as root-equivalent.

Turn off Tailscale SSH on devices that do not need it by running tailscale set –ssh=false. Confirm another way to reach the device first, because the documentation warns that you may lose access. () Remove app connector permissions where they are unused, remove serve forwards that point to Unix sockets, and turn on node-key expiry. If a device is compromised, delete it at the control plane, because reimaging the host does not revoke keys that were already copied.

Credentials matter as much as code. Tailscale reported that an AI agent used a stolen Tailscale credential to enroll 181 nodes during the Hugging Face intrusion, although Tailscale said no vulnerability was exploited.

Readers should review the Tailworm report directly and watch Tailscale’s security bulletins for an official response. Some commenters dispute how severe the findings are, and the results come from lab tests rather than confirmed breaches. Still, the report shows how one compromised device can become a path to many servers when access rules are too broad. Teams that use Tailscale SSH should review their rules today and read Tailscale’s SSH documentation before making changes.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device appeared first on Cyber Security News.