Tailscale SSH port forwarding let an ordinary session reach a system socket through a process running as root, according to research published on October 25. The test then obtained root access and read the system password file. No administrator rights were needed at the start. [1]
The attacker did need a compromised device already permitted to connect to the target. Forwarding also had to be enabled. Those conditions put the immediate exposure inside the network’s SSH access rules. [1]
Erica Windisch of Cyberdione Labs tested Tailscale version 1.104.2 and headscale version 0.29.5, the self-hosted alternative to Tailscale’s control service. Her report describes laboratory results. The Hacker News reports that no other researcher has publicly reproduced them, and Tailscale has not confirmed the specific technical claims. [1]
Tailscale says it has found issues it is working to fix and is “not recommending that everyone disable Tailscale SSH.” Windisch reports that an allowed session with forwarding enabled reached root. The configuration matters before a patch arrives. [1]
The forwarding setting also depends on who runs the control service. Tailscale’s hosted service allows forwarding to be disabled per rule. On the tested headscale release, it cannot be disabled. For administrators running that version, removing the forwarding permission is therefore unavailable as a separate remedy. [1]
Windisch describes the findings as “wormable.” That claim needs its conditions attached: the reported spread followed connections the access rules already permitted, and it was measured in a lab. Rules naming individual source and destination devices stopped the spread in testing. [1]
The prerequisite foothold deserves equal attention. In separate reporting, BleepingComputer describes a coding agent attempting to install a malicious npm package after reading an AGENTS.md instruction file in a customer’s Downloads folder. Researchers could not establish how the file arrived. Their reconstructed tests demonstrated execution through malicious instructions. [2]
There is no reported connection between those findings and Tailscale. They do describe a concrete route to the device compromise the SSH attack requires. Once a permitted device is compromised, its existing access becomes the attacker’s starting position. [2] [1]
An additional login step, Tailscale’s SSH check mode, adds a barrier but does not repair the reported privilege escalation. The control that stopped propagation in Windisch’s tests was narrower SSH permission: one named source device, one named destination. A compromised device then had fewer places to go. [1]