The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
Tailscale develops a software-defined mesh virtual private network (VPN) built on WireGuard that lets users connect computers, servers, and cloud instances from anywhere to the same encrypted mesh network (“tailnet”) via direct peer-to-peer (P2P) connections.
Cyberdione Labs discovered 11 flaws (collectively known as Tailworm) that still lack patches during a security audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server.
“All findings were verified by reproduction in a lab environment on unmodified, released software (tailscale v1.104.2, headscale v0.29.5),” said Erica Windisch, founder of Cyberdione Labs, who reported the flaws to Tailscale and publicly released the details.
“It is the opinion of the researchers that rapid awareness of these flaws will expediate remediation across impacted devices. These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort.”
The table below classifies the security issues by the component they affect. The most critical issue is in Tailscale’s SSH server and could let authorized attackers gain code execution with root privileges through Unix-socket forwarding on a targeted tailnet.
On Monday, the Tailscale team said it received Cyberdione Labs’ report and was working on patches to address these security issues by the end of today.
The developers also confirmed that the reported flaws are “serious” as they could let threat actors with permissions on targeted systems take actions with escalated privileges.
“Most of the Tailscale SSH issues we’ve identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges,” Tailscale said.
“These are serious security issues, and we’re treating them accordingly. Exploitation depends on the permissions granted to the connecting user or device, the system’s configuration, and other conditions. We’re continuing to verify the full scope of the findings and which configurations may be affected.”
However, despite the severity of the issues, Tailscale said it doesn’t recommend that users disable the Tailscale SSH feature.
“If you want to jump to the most important part, based on our current assessment, we’re not recommending that everyone disable Tailscale SSH,” said Mike Shaver, VP of Engineering at Tailscale.
Instead, the Tailscale team shared measures that should mitigate some of these flaws:
The Tailscale devs aim to push a new version that fixes these issues by the end of Tuesday, October 27, and urged users to prepare to update and “apply the patched Tailscale client release when it becomes available.”
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
TeamViewer urges users to patch severe flaws “as soon as possible”
Google fixes actively exploited Android zero-day on Pixel devices
New Microsoft Defender ‘ShieldCrash’ zero-day grants SYSTEM access
New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges
Sonicwall warns of new SMA1000 zero-day exploited in attacks
Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches
Microsoft releases emergency .NET patches for critical Brotli flaw
PHP2Shell security flaws now sucessfully exploited in the wild
Get your free 30-day browser security assessment
Who really has control of your AI agent? Gen is taking on the agent trust problem.
CTA: Hijacked sessions reach every app your users touch. See how Exaforce agents contain identity attacks
What can your AI agents actually do? Learn to control every action in our Nov. 18 webinar.
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
