Threat reportVulnerabilityTL-2026-4542
Tailscale 'Tailworm' Vulnerabilities (11 Findings in Tailscale SSH, App Connectors, Serve, DERP and Headscale) Allowing Root Privilege Escalation (Tailscale v1.104.2, Headscale v0.29.5)
Tailscale 'Tailworm' Vulnerabilities (11 Findings in (TL-2026-4542), also tracked as Tailworm, is a high-severity software vulnerability, first published 2026-10-27. It has no confirmed attribution, affects Tailscale Tailscale client (tailscaled, Tailscale SSH, app connectors, maps to 8 MITRE ATT&CK techniques (T1021.004, T1070.004, T1078), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4542
- Threat ID
- TL-2026-4542
- Also known as
- Tailworm
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, enterprise, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Tailscale 'Tailworm' Vulnerabilities (11 Findings in
Malware and tooling: Tailscale
How Tailscale 'Tailworm' Vulnerabilities (11 Findings in works
Cyberdione Labs (Erica Windisch) disclosed 11 findings, named 'Tailworm', in Tailscale v1.104.2 and headscale v0.29.5 that include root privilege escalation via Tailscale SSH socket forwarding, ACL bypass in app connectors, authkey capture and rogue device enrollment via a TOCTOU race, and memory-exhaustion denial of service. No CVEs have been assigned and no in-the-wild exploitation has been reported.
Tailworm is a set of 11 findings from a security assessment of Tailscale v1.104.2 and headscale v0.29.5 run October 22-24, 2026 by Cyberdione Labs Corporation (founder Erica Windisch). Tailscale published a heads-up on October 26, 2026 saying someone already authorized to connect over Tailscale SSH may be able to act beyond the permissions of their configured local user, including gaining elevated privileges. Public disclosure followed on October 27, 2026 at tailworm.com and was covered by BleepingComputer. Fixes had been merged into the upstream tailscale/tailscale and tailscale/gliderssh main branches before a numbered release. Tailscale targeted a patched client release for the end of October 27, 2026. Headscale's fix was pending a registration-cache rework (PR #3586). No CVE identifiers or CVSS scores have been assigned.
Tailscale SSH findings (gliderssh and tailscaled): T3 lets a peer holding an SSH policy rule that allows local forwarding use 'ssh -L' so that tailscaled, running as root, dials or writes to privileged unix sockets. T2 lets a peer with a remote-forwarding policy use 'ssh -R' with BindUnlink so that root replaces root-owned sockets. The T2-RACE and T3-RACE findings are a time-of-check/time-of-use race that defeats the path allowlist. The report's critical chain is a raced rebind held for four minutes or longer. This gives an HTTP man-in-the-middle on the control socket and byte-exact authkey capture. The authkey is then used on a scratch node to enroll a rogue device under the victim's identity. The same race can also be used for arbitrary file deletion. T1 is a window-change and environment churn issue in session handling that makes the root daemon run out of memory (about 536 MB in 7 seconds) from an authenticated SSH session.
App connector, control server, DERP and serve findings: C1 (conn25 app connectors) lets a user granted the app capability choose unrestricted egress destinations. That bypasses network ACLs and exposes cloud metadata services and internal LANs. C2, C3 and C4 (headscale v0.29.5 and the DERP client) cover memory exhaustion, auth-cache eviction and unbounded response reads, reachable by an insider or an attacker positioned as a relay. SERVE-F-1 lets a remote peer reach permit-write localapi through 'tailscale serve --tcp' forwarding to the agent socket. SERVE-F-2 is a symlink race against an isTailscaledSocket guard that is checked only at configuration time. SERVE-F-3 is client-side-only funnel entitlement enforcement. SERVE-F-4 is a configuration note: TS_SERVE_ALLOW_ALL_INTERFACES exposes serve outside the tunnel to the LAN. SERVE-F-5 is an h2 shared-context race that leaks capabilities across mounts and bypasses authorization.
Exploitation mostly requires an already authorized tailnet identity or device, or a specific operator configuration. The findings are therefore insider-threat and lateral-movement risks rather than unauthenticated remote exploits. Severity HIGH is an analyst estimate based on root-escalation impact; it is not a vendor-assigned rating. Stolen node state can persist after reimaging, so the report recommends deleting compromised devices at the control plane.
MITRE ATT&CK techniques used in TL-2026-4542
Lateral Movement
T1021.004 Remote Services: SSH; T1550 Use Alternate Authentication Material
Defense Evasion
T1070.004 Indicator Removal: File Deletion
Initial Access
Command and Control
Persistence
Credential Access
Affected products and versions in Tailscale 'Tailworm' Vulnerabilities (11 Findings in
- Tailscale — Tailscale client (tailscaled, Tailscale SSH, app connectors, serve/funnel, DERP client)
Vulnerable versions: 1.104.2
Fixed in: Release following 1.104.2 (targeted 2026-10-27) - juanfont — headscale
Vulnerable versions: 0.29.5
Fixed in: Pending registration-cache rework (PR #3586) - Tailscale — gliderssh (SSH library)
Vulnerable versions: Versions prior to upstream main-branch fix
Fixed in: Upstream main branch (session memory fix merged)
Remediation for Tailscale 'Tailworm' Vulnerabilities (11 Findings in
Patches
- Upgrade the Tailscale client to the release following v1.104.2 (targeted end of 2026-10-27)
- Upgrade headscale beyond v0.29.5 once the registration-cache rework (PR #3586) is released
- Pull the gliderssh session memory fix
Immediate actions
- Set TS_SSH_DISABLE_FORWARDING=1 on Tailscale SSH hosts
- Review and restrict Tailscale SSH access policies to necessary users and devices; use per-pair SSH rules and remove identity-wide or tag-wide accepts
- Audit 'tailscale serve' configuration for unix-socket forwards and avoid TS_SERVE_ALLOW_ALL_INTERFACES
- Delete compromised devices at the control plane; reimaging alone is insufficient
Workarounds
- Tighten Tailscale SSH access temporarily; Tailscale does not recommend disabling Tailscale SSH entirely
Longer-term hardening
- Apply a kernel-layer (netfilter) destination allowlist on app connector hosts
- Enforce node-key expiry and TPM or Secure Enclave key binding
- Monitor for same machine key appearing from a new network or ASN and for unrequested Tailscale authentication prompts
Weaknesses (CWE) in Tailscale 'Tailworm' Vulnerabilities (11 Findings in
Timeline of Tailscale 'Tailworm' Vulnerabilities (11 Findings in
- Cyberdione Labs begins a security assessment of Tailscale v1.104.2 and headscale v0.29.5
- Assessment concludes with 11 findings across Tailscale SSH, app connectors, serve/funnel, DERP and headscale
- Tailscale publishes an SSH investigation update warning that authorized SSH users may exceed their local user permissions and may gain elevated privileges; recommends TS_SSH_DISABLE_FORWARDING=1
- Tailscale targets a patched client release by end of day; headscale fix remains pending the registration-cache rework (PR #3586)
- BleepingComputer reports that Tailscale warned of the Tailworm SSH flaws allowing root privilege escalation
- Cyberdione Labs publishes the Tailworm report at tailworm.com; fixes are merged upstream in tailscale/tailscale and tailscale/gliderssh ahead of a numbered release
Sources cited for Tailscale 'Tailworm' Vulnerabilities (11 Findings in
Detection coverage for TL-2026-4542
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4542 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.