A recent report has highlighted significant security vulnerabilities in Tailscale SSH that could allow attackers to escalate privileges from a single compromised device to gain root access across multiple servers. The report, named 'Tailworm', was published by Erica Windisch from Cyberdione Labs on October 25, 2026. It details 11 findings across various components of Tailscale, including its SSH server and open-source server headscale, tested on versions 1.104.2 and 0.29.5, respectively. The most critical issue involves the SSH server running inside tailscaled, which operates with root privileges. This setup can be exploited when a user has permissions to forward Unix sockets, allowing unauthorized access to system files like the /etc/shadow password file. The report demonstrates how a compromised device can spread root access across a network without needing passwords or keys.

Tailscale's design relies on a private mesh network where devices trust each other based on policy rules. This trust model assumes that devices are inherently safe, potentially allowing a single breach to compromise an entire network. The report suggests that per-pair access rules can mitigate the spread of such attacks, as they were effective in lab tests. Threat actors, like the Scattered Spider group, have already leveraged Tailscale to navigate networks undetected.

Beyond SSH, the report also identifies vulnerabilities in Tailscale's experimental app connector feature and a memory issue within headscale. These flaws could allow unauthorized traffic routing and memory exhaustion attacks. Despite the severity of these findings, Tailscale has not yet issued an official patch or response. Administrators are advised to implement interim security measures, such as restricting broad SSH access rules and turning off unnecessary Tailscale SSH functionalities, following the researcher's recommendations. Reviewing the Tailworm report and Tailscale's security bulletins is crucial for teams using Tailscale to secure their networks.