# Tailscale 'Tailworm' Vulnerabilities (11 Findings in Tailscale SSH, App Connectors, Serve, DERP and Headscale) Allowing Root Privilege Escalation (Tailscale v1.104.2, Headscale v0.29.5)

> Cyberdione Labs (Erica Windisch) disclosed 11 findings, named 'Tailworm', in Tailscale v1.104.2 and headscale v0.29.5 that include root privilege escalation via Tailscale SSH socket forwarding, ACL bypass in app connectors, authkey capture and rogue device enrollment via a TOCTOU race, and memory-exhaustion denial of service. No CVEs have been assigned and no in-the-wild exploitation has been reported.

- **Published:** 2026-10-27T14:35:19Z
- **Last reviewed:** 2026-10-27T14:35:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4542
- **ID:** TL-2026-4542
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Tailworm is a set of 11 findings from a security assessment of Tailscale v1.104.2 and headscale v0.29.5 run October 22-24, 2026 by Cyberdione Labs Corporation (founder Erica Windisch). Tailscale published a heads-up on October 26, 2026 saying someone already authorized to connect over Tailscale SSH may be able to act beyond the permissions of their configured local user, including gaining elevated privileges. Public disclosure followed on October 27, 2026 at tailworm.com and was covered by BleepingComputer. Fixes had been merged into the upstream tailscale/tailscale and tailscale/gliderssh main branches before a numbered release. Tailscale targeted a patched client release for the end of October 27, 2026. Headscale's fix was pending a registration-cache rework (PR #3586). No CVE identifiers or CVSS scores have been assigned.

Tailscale SSH findings (gliderssh and tailscaled): T3 lets a peer holding an SSH policy rule that allows local forwarding use 'ssh -L' so that tailscaled, running as root, dials or writes to privileged unix sockets. T2 lets a peer with a remote-forwarding policy use 'ssh -R' with BindUnlink so that root replaces root-owned sockets. The T2-RACE and T3-RACE findings are a time-of-check/time-of-use race that defeats the path allowlist. The report's critical chain is a raced rebind held for four minutes or longer. This gives an HTTP man-in-the-middle on the control socket and byte-exact authkey capture. The authkey is then used on a scratch node to enroll a rogue device under the victim's identity. The same race can also be used for arbitrary file deletion. T1 is a window-change and environment churn issue in session handling that makes the root daemon run out of memory (about 536 MB in 7 seconds) from an authenticated SSH session.

App connector, control server, DERP and serve findings: C1 (conn25 app connectors) lets a user granted the app capability choose unrestricted egress destinations. That bypasses network ACLs and exposes cloud metadata services and internal LANs. C2, C3 and C4 (headscale v0.29.5 and the DERP client) cover memory exhaustion, auth-cache eviction and unbounded response reads, reachable by an insider or an attacker positioned as a relay. SERVE-F-1 lets a remote peer reach permit-write localapi through 'tailscale serve --tcp' forwarding to the agent socket. SERVE-F-2 is a symlink race against an isTailscaledSocket guard that is checked only at configuration time. SERVE-F-3 is client-side-only funnel entitlement enforcement. SERVE-F-4 is a configuration note: TS_SERVE_ALLOW_ALL_INTERFACES exposes serve outside the tunnel to the LAN. SERVE-F-5 is an h2 shared-context race that leaks capabilities across mounts and bypasses authorization.

Exploitation mostly requires an already authorized tailnet identity or device, or a specific operator configuration. The findings are therefore insider-threat and lateral-movement risks rather than unauthenticated remote exploits. Severity HIGH is an analyst estimate based on root-escalation impact; it is not a vendor-assigned rating. Stolen node state can persist after reimaging, so the report recommends deleting compromised devices at the control plane.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1021.004 Remote Services: SSH
- T1557 Adversary-in-the-Middle
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1098 Account Manipulation
- T1070.004 Indicator Removal: File Deletion
- T1090 Proxy

## Sources

- [Tailscale warns of SSH flaws allowing root privilege escalation (BleepingComputer)](https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/)
- [Tailworm - Cyberdione Labs vulnerability report](https://tailworm.com/)
- [Tailscale SSH investigation update](https://tailscale.com/ssh-investigation-update)
- [Tailscale GitHub repository (upstream fixes)](https://github.com/tailscale/tailscale)
- [gliderssh GitHub repository (session memory fix)](https://github.com/tailscale/gliderssh)
- [headscale PR #3586 registration-cache rework](https://github.com/juanfont/headscale/pull/3586)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4542