> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Unpatched Tailscale SSH Flaws: What to Change Now
- URL: https://blog.harshkohli.com/tailscale-ssh-tailworm-unpatched-flaws/
- Published: 2026-10-25T19:03:15.000Z
- Updated: 2026-10-25T19:03:15.000Z
- Description: A researcher's Tailworm report claims Tailscale SSH can give a hacked device root on other servers. No patch yet. Here's what to lock down now.
- Author: Harsh Kohli
- Tags: Tech News, Software

If you use Tailscale SSH to hop between your servers, this one is worth ten minutes of your time. A researcher has published a long report, called Tailworm, describing 11 problems in Tailscale and in headscale, the self-hosted control server many home labs use. The headline issue: someone who already controls one device on your tailnet may be able to turn an ordinary SSH session into root on another machine. There's no patch yet. I first saw it in [The Hacker News' post on X](https://x.com/TheHackersNews/status/2114412761254093168?ref=blog.harshkohli.com).

## What happened

Erica Windisch of Cyberdione Labs posted the [Tailworm report](https://tailworm.com/?ref=blog.harshkohli.com) on October 25\. She says she tested Tailscale v1.104.2 and headscale v0.29.5 in a lab between October 22 and 24, on unmodified released builds.

The main finding sits in how Tailscale SSH handles Unix socket forwarding (the `ssh -L` and `ssh -R` kind). The SSH server inside `tailscaled` runs as root, and according to the report it does some of the forwarding work with root's privileges. In her tests, a normal session reached a root-only Docker socket and read `/etc/shadow`. A separate race-condition trick got past the path checks that are meant to limit which sockets you can touch. In the full lab chain she says she captured an auth key and enrolled a rogue node, on a tailnet that didn't have Tailnet Lock switched on.

Other findings cover the experimental app connector feature (conn25), `tailscale serve`, the DERP relay client and memory exhaustion in headscale.

Tailscale hasn't put out a bulletin, CVE or fixed version for any of this. Its [security bulletins page](https://tailscale.com/security-bulletins?ref=blog.harshkohli.com) still tops out with unrelated fixes. [The Hacker News reports](https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html?ref=blog.harshkohli.com) that Tailscale's VP of engineering, Mike Shaver, said on Reddit that the company got the report, had already been looking at the same areas, found issues it's fixing, and isn't telling everyone to turn Tailscale SSH off.

## Why it matters

Tailscale SSH doesn't ask for a password or key. Your device identity plus one policy rule decides who gets in. That's convenient, but it means one infected laptop or one compromised web server can be the starting point, with no credentials needed after that.

Some caveats, because they matter. Nobody else has publicly reproduced these results yet, the proof-of-concept code isn't public, and some readers have pushed back on the "wormable" label. The disclosure was also rushed: Windisch says she sent the report to Tailscale's security contact shortly before publishing. So I'd treat this as serious but unconfirmed.

The headscale angle is the bit that worries me most for home labs. The report says forwarding can't be turned off on headscale v0.29.5, so any SSH grant there should be treated as root on the target.

## What to do

- Open your tailnet policy and look at every `ssh` rule. Swap broad tag-wide or group-wide rules for specific source-to-destination pairs.
- On Tailscale's hosted service, turn forwarding off in rules that don't need it.
- On headscale, keep SSH grants to the bare minimum, or use plain OpenSSH over the tailnet until a fix lands.
- Remove app connector permissions from devices that don't need them, and delete any `tailscale serve` forward pointing at a Unix socket.
- Turn on node key expiry and consider Tailnet Lock.
- If a machine might be compromised, remove it in the admin console. Reimaging alone won't revoke keys that were already copied.
- Keep auto-updates on so the fix lands as soon as it ships.

If you're still deciding how to set up remote access at home, my [Tailscale vs WireGuard comparison](https://blog.harshkohli.com/tailscale-vs-wireguard/) covers the trade-offs, and plain WireGuard doesn't include an SSH server at all.