Tailscale has released version 1.104.4 to address issues within its integrated SSH server. These flaws could permit an adversary to access services and files on distinct servers that are restricted to root user access.
The vulnerabilities reside in the mechanism by which Tailscale SSH forwards network connections, a function performed by the Tailscale background process operating with root privileges. To exploit these weaknesses, an attacker must meet specific prerequisites.
The Tailscale security team is currently addressing nearly a dozen security weaknesses. These could potentially lead to credential theft, server crashes, or the acquisition of root privileges.
Cyberdione Labs identified 11 flaws, termed Tailworm, during an audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. Erica Windisch, Cyberdione Labs founder, stated, "All findings were verified by reproduction in a lab environment on unmodified, released software (tailscale v1.104.2, headscale v0.29.5)."
The most severe issue involves Tailscale's SSH server, allowing authorized attackers to achieve code execution with root privileges via Unix-socket forwarding on a targeted tailnet.
Tailscale confirmed that the reported flaws are "serious," as they could allow threat actors with permissions on targeted systems to execute actions with elevated privileges. Tailscale noted, "Most of the Tailscale SSH issues we've identified concern privilege escalation."
Although severe, Mike Shaver, VP of Engineering at Tailscale, stated that the company does not advise users to disable the Tailscale SSH feature. The team aims to deploy a fix by the end of Tuesday, October 27, and urged users to update when the patched client release is ready.
These developments underscore the operational risk associated with internal privilege escalation vectors within connectivity platforms. The Blue Report 2026 indicates that defense efficacy can diminish sharply once initial access is established by malicious actors utilizing valid credentials.
