Erica Windisch of Cyberdione Labs published a report on October 25 describing 11 weaknesses in Tailscale and Headscale, several with no fix available at the time of release. The report, titled “Tailworm,” includes paths to root access over Tailscale SSH.
When it appeared, there was no Tailscale bulletin, CVE or fixed version. The findings came from three days of lab testing, October 22 to 24, against Tailscale 1.104.2 and Headscale 0.29.5.
Tailworm Root Path Through Tailscale SSH Port Forwarding
The most serious finding applies when Tailscale SSH allows port forwarding. An attacker who controls one device permitted by the access rules can reach privileged local services, including Unix sockets, on target servers. From there the attacker can gain root, extract node authentication keys, enroll an attacker-controlled machine and move laterally.
The attack does not need stolen passwords or keys, but it does require a first foothold on a permitted device. The report also says experimental app connectors and self-hosted Headscale deployments add risk.
Tailworm Lab Tests Show No Reported Exploitation
The report describes lab tests, not attacks on real networks, and no exploitation has been reported. It is unclear whether AI tools contributed to the findings.
Tailscale Responds on Reddit and Points to Pending Pull Requests
Tailscale vice president of engineering Mike Shaver said on Reddit that the company had received the report and was already examining these areas with outside specialists. He said Tailscale had found issues it is fixing, and that it is “not recommending that everyone disable Tailscale SSH.”
Tailscale says a patched client is close. Upstream pull requests 21937 and 21942 move port forwarding into an isolated SSH monitor, and the company is redesigning Unix socket authorization.
Tailscale Disclosure Dispute Over Publishing Before Fixes Land
Reporting describes a dispute over the decision to publish before fixes were available. Tailscale confirmed it had received the report.
Who Uses Tailscale and Why the Exposure Matters
Tailscale customers cited in reporting include Microsoft, Nvidia, SAP, Duolingo, Instacart, Airbus and Mistral AI. The report does not claim those customers are vulnerable; it describes exposure for Tailscale SSH setups with broad access permissions.
Tailscale Lateral Movement From a Single Permitted Device
For deployments with broad access rules, any compromised permitted device becomes a possible starting point for privilege escalation and movement to other servers. The ability to extract node authentication keys and enroll a new machine means an attacker could add a device to the network under their control rather than only borrow an existing one.
Headscale, the self-hosted control server alternative, was tested at version 0.29.5, and the report lists it among the affected products, though the details of the Headscale findings were not described in the coverage reviewed.
Until Tailscale ships its patched client, the company’s public position is that Tailscale SSH remains usable while it completes its fixes and the redesign of Unix socket authorization.
Timeline and Scope of the Tailworm Testing
The research ran for three days, from October 22 to 24, and the report went public on October 25, the same day Tailscale responded publicly. Tailscale had no bulletin, CVE or fixed version ready at publication.
Windisch tested Tailscale 1.104.2 and Headscale 0.29.5. The 11 weaknesses were found in a lab setting, and the report does not describe attacks on real networks. For Tailscale SSH setups with broad access permissions, the finding is that a compromised permitted device can lead to privilege escalation and lateral movement.
Tailscale’s stated response has three parts: it is working on a patched client, it is redesigning Unix socket authorization, and it is not recommending that everyone disable Tailscale SSH. The company says it found issues of its own while examining the areas the report covers, which it is fixing with outside specialists.
