Erica Windisch of Cyberdione Labs published “Tailworm” on October 25: 11 lab findings in Tailscale 1.104.2 and headscale 0.29.5. The big one: with Tailscale SSH and port forwarding allowed, an attacker who already controls one device can get root on other machines the rules let it reach. There’s no CVE, no bulletin and no fixed version yet.
What you need to know
- This isn’t internet RCE. The attacker needs a foothold first: a bad web app, a poisoned package, phishing or stolen logins.
- In the lab, SSH forwarding got the root Tailscale process to connect to sockets only root should touch. One chain captured an enrollment key and joined an attacker machine as a trusted node. That last step only worked fully without Tailnet Lock.
- On Tailscale’s hosted service, forwarding can be turned off per rule. On headscale 0.29.5 it can’t, so treat every SSH grant there as root on the target.
- Other findings hit app connectors (including reaching a cloud metadata service),
tailscale serve, DERP and headscale. - The report wasn’t coordinated with Tailscale first, and nobody has reproduced it publicly yet. Tailscale says it’s working on fixes and isn’t telling everyone to turn off Tailscale SSH.
What to do now
- Write SSH rules as single source-to-destination pairs. That alone stopped the spread in testing.
- Turn off SSH forwarding where you can, and drop app connector permissions nobody needs.
- Remove any
tailscale serveforward that points at a Unix socket. - Keep node-key expiry on, turn on Tailnet Lock, and if a device gets hit, delete it in the admin console. Reimaging doesn’t revoke keys already copied off it.
My take
Mesh VPNs are great, but “one rule lets everything reach everything” is how one bad laptop becomes a bad night. Least privilege isn’t optional just because it’s your tailnet. Tighten the rules today, and patch the moment Tailscale ships a fix.
Have a blessed day! And Happy Hacking!
