Researcher publishes 11 unpatched Tailscale SSH flaws without warning

A security researcher skipped the usual disclosure playbook and published eleven unfixed holes in Tailscale's SSH feature, the kind startups lean on daily to reach servers without a traditional VPN. Tailscale has no patch, no advisory, and no CVE number out yet.

Erica Windisch, a researcher at Cyberdione Labs, dropped a report called Tailworm on October 25, 2026. It lays out eleven vulnerabilities she found in Tailscale's open-source client, version 1.104.2, and in headscale, the open-source server alternative, version 0.29.5. The worst of the eleven is a race condition in how Tailscale SSH handles Unix socket forwarding: run it, and the forwarded connection executes as root. Picture an attacker who already controls one approved device on a tailnet, with an SSH rule that permits forwarding. That attacker can use the flaw to reach root on another machine and mint a new enrolment key - in effect, planting a rogue device the network trusts.

That detail matters because of who relies on this feature. Tailscale is the WireGuard-based mesh networking tool thousands of startups use to let engineers SSH into dev boxes, internal tools and production servers from anywhere. No traditional VPN gateway needed. For a five-person team or a 500-person engineering org, Tailscale SSH is often the trust boundary between a laptop and the server that runs the product.

Windisch ran her lab tests from October 22 through 24 against unmodified releases, according to the report covered by pwn.watch. They showed the exploit chain could in principle spread across a network at machine speed once it started. She flagged that as wormable, which is where the Tailworm name comes from.

Windisch says she sent her findings and a proof of concept to Tailscale's security contact ahead of publication. What she did not do was wait for coordinated disclosure, the norm where a vendor gets weeks or months to ship a fix before details go public. She went public anyway.

Reaction on X split fast. Some researchers framed it as reckless: it handed attackers a map, they argued, with no patch to defend against. Others saw a researcher forcing a vendor's hand after what she felt was an inadequate response window.

Here's the thing worth separating from the drama: the flaws are not a remote, unauthenticated way into a tailnet from the open internet. Every path Windisch describes needs an attacker who already has a foothold - an approved device sitting inside the network, with SSH access rules that permit forwarding. That's post-compromise lateral movement. Nobody is walking in through the front door. The blast radius is meaningfully smaller than a zero-click remote exploit. But it is exactly the scenario that turns a compromised laptop or a leaked service account from merely bad into catastrophic.

Tailscale has not confirmed the findings.

Mike Shaver, the company's VP of engineering, responded on Reddit. He acknowledged the report and the ongoing work to address it, but stopped short of validating each of the eleven items individually. His advice: review your SSH access policies, tighten who is allowed to forward ports and keep automatic updates on, rather than switching Tailscale SSH off outright. As of this writing, Tailscale has issued no official bulletin, no CVE identifiers and no patched release tied to the Tailworm findings.

This isn't Tailscale's first brush with SSH-specific bugs. The company's own security advisory log tracks a string of Tailscale SSH issues disclosed and patched earlier this year, under identifiers like TS-2026-006, TS-2026-009 and TS-2026-010. They covered problems like numeric UID access bypassing ACL restrictions and environment variables leaking onto local process command lines. Those went through the normal channel: reported privately, fixed, then disclosed with a version number attached. Tailworm breaks that pattern. And that's what has security teams nervous this week: the bugs, yes, but also the fact that there's nothing yet to install against them.

For now, Windisch's own advice is blunt: disable Tailscale SSH and App Connectors if you can't immediately audit who has forwarding permissions on your tailnet. For startups that built their entire remote access model around Tailscale's convenience, that's an uncomfortable ask. It's also the clearest sign of how deeply this tool has embedded itself as critical infrastructure rather than a nice-to-have.

Also read: Rigetti Computing stock jumps 49% this week on Air Force deal and quantum rally • Cloudflare's CEO Says Worse Bugs Than PHP2Shell Are Already Being Patched • Anthropic quietly separates Claude Agent SDK usage from subscription limits

This article is posted in Technology News, check it out for more related stories.