Researcher publishes 11 unpatched flaws in Tailscale and headscale, mostly in Tailscale SSH

Erica Windisch of Cyberdione Labs published 11 findings under the name Tailworm (tailworm.com) without coordinated disclosure, so the vendor had no time to patch first. No patches or CVEs had been reported by October 25.

What the researcher reports:

• The findings are in five groups: Tailscale's SSH server, its serve and app connector features, the DERP relay client, and headscale, the open-source self-hosted Tailscale control server.
• She tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and 24, 2026.
• The most serious group is in Tailscale SSH, which runs inside tailscaled, a process with root privileges. In her lab, race conditions let one compromised device get root on other servers and add a rogue node to the network. One bug turns authorized non-root access into root through unix socket forwarding.
• Reports say the attack follows the SSH policy and needs port forwarding to be enabled. The attacker must already control a device on the tailnet that policy lets use Tailscale SSH.

Tailscale's response: according to a summary post, VP of Engineering Mike Shaver replied on Reddit that, on current assessment, Tailscale does not recommend turning off Tailscale SSH while patches are prepared. Suggested steps are to review SSH access policies and remove SSH forwarding permissions that are not needed. The summary says Tailscale gave no release date for patches. The Hacker News, which also covered the report, says Tailscale told it a fix is coming.

The disclosure drew wide attention on X: the posts by IntCyberDigest and The_Cyber_News had 4,539 and 3,314 points by October 25.