Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)
Severity: high · Patch status: partial · Since 2026-10-24
Erica Windisch (Cyberdione Labs) published "Tailworm" on 2026-10-24, about two hours after sending it to Tailscale. The report lists 11 findings from lab testing of Tailscale v1.104.2 and headscale v0.29.5. The main issue is in Tailscale SSH: unix-socket forwarding checked socket paths by name but acted on them as root. A peer the tailnet policy already allows to SSH in could therefore dial root-only sockets with ssh -L, such as the Docker socket or the tailscaled LocalAPI. With ssh -R it could replace root-owned sockets, and a check-then-use race also defeated the path allowlist. The result is root on the target. Tailscale shipped fixes in 1.104.4 on 2026-10-28. Its bulletins are TS-2026-014 (SSH socket forwarding), TS-2026-015 (SSH session memory exhaustion that can OOM-kill tailscaled), TS-2026-016 (Serve unix backends reaching privileged sockets, including the LocalAPI) and TS-2026-017 (HTTP/2 Serve leaking Tailscale-App-Capabilities across mounts). An attacker first needs a foothold on an authorized device and a matching SSH grant. Movement is limited to connections the policy file allows, so Tailscale disputes the "worm" label. No in-the-wild exploitation has been reported. Not everything is fixed. The researcher reports the headscale memory-exhaustion issue as still pending. The Funnel entitlement check, enforced only by the CLI, has no fix. The Conn25 app-connector egress flaw affects only an unreleased, pre-production feature, which Tailscale says will be fixed before release. No CVEs have been assigned.
What to do
- Upgrade every node that runs Tailscale SSH or Serve to Tailscale 1.104.4 or later (`tailscale version`)
- Until upgraded, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it; this keeps SSH working but blocks the socket-forwarding path
- Audit SSH rules in the tailnet policy file: replace identity- or tag-wide accept rules with per-pair grants, and use check mode for sensitive hosts
- Self-hosted headscale: treat every SSH grant as root-equivalent (forwarding cannot be disabled there), set memory limits and restart supervision, and throttle registration until a fix ships
- If a tailnet device may have been compromised, delete it in the admin console and rotate reachable auth keys and credentials; reimaging alone does not revoke copied node keys
Fixed versions
- Tailscale 1.104.4 (released 2026-10-28)
Sources
All live incidents on Threat Watch
