A security researcher has identified a potential vulnerability in Tailscale SSH that could allow an attacker with a foothold on one device to gain root access to other reachable servers, as first reported by The Hacker News.
The findings, published on Oct. 25 in a report titled Tailworm by Erica Windisch of Cyberdione Labs, detail how a compromised device can be used to escalate privileges without stolen passwords or keys. The attack requires Tailscale SSH to be configured with port forwarding enabled and relies on existing network access rules. Windisch demonstrated in a lab setting that the process could potentially spread across a network at machine speed, a characteristic described as wormable. The research tested Tailscale version 1.104.2 and headscale version 0.29.5. Tailscale has acknowledged the report and stated that it is working with security specialists to address the identified issues. While no official security bulletin or patch has been released, the company advises users to review access rules and consider enabling SSH check mode. The report also highlights concerns regarding app connectors and other features. Industry experts emphasize the importance of restricting access rules to specific source-to-destination pairs and maintaining robust device security to mitigate these risks until a formal fix is available.
Source: The Hacker News
