Tailworm: 11 claimed Tailscale and headscale flaws, published without coordination. What is confirmed

What happened

Researcher Erica Windisch of Cyberdione Labs published a report called Tailworm at tailworm.com. It lists 11 findings in Tailscale 1.104.2 and headscale 0.29.5, the self-hosted control server.

The report says testing ran from 22 to 24 October 2026. The page was online by 24 October 2026 (server timestamp 17:38 UTC). It reached Hacker News at 00:59 UTC on 25 October.

The disclosure was not coordinated. On Hacker News, Windisch wrote that the findings were "reported but not coordinated". The report argues that "infrastructure is vulnerable today" and that fast awareness speeds up fixes.

At the time of writing, there is no CVE, no GitHub advisory, no Tailscale security bulletin and no fixed release for these findings.

What Tailscale says

Mike Shaver, Tailscale's VP of Engineering, posted a statement on r/Tailscale at 00:41 UTC on 25 October 2026. Key points:

• Tailscale has received the researcher's report and is reviewing it.
• Its own teams, with outside security specialists, had already been investigating. That work "identified issues we're working to fix".
• Most issues found so far concern what happens after someone is authorized to connect, especially Unix privileges and SSH forwarding. A session "may be able to do more than the configured local user should be allowed to do".
• Tailscale says this "isn't the same as an unauthenticated attacker being able to connect to arbitrary machines".
• The full scope is still being validated, including which configurations are affected.
• "Based on our current assessment, we're not recommending that everyone disable Tailscale SSH."
• Tailscale will publish a security advisory with confirmed findings, affected configurations and patches, then a technical write-up.

On Hacker News, a Tailscale engineer also questioned one of the report's claims. Windisch says every node can see the full peer list. He said that may be a headscale difference: Tailscale's own control plane trims the network map, so nodes with no ACL path to each other do not see each other.

The 11 findings, as the researcher describes them

The severities below are the researcher's own labels. They are not CVSS scores. Tailscale has not confirmed them one by one.

1. Tailscale SSH, local Unix socket forwarding runs as root and can reach root-only sockets. High.
2. Tailscale SSH, remote Unix socket forwarding can replace root-owned sockets. High.
3. A race (TOCTOU) in the forwarding path checks gets around the allowed-directory list. High. The report links this to key theft and enrolling a rogue node in a lab.
4. App connectors (the experimental conn25 feature): a user allowed to use one app can send traffic to any destination the connector can reach, including cloud metadata. High.
5. Tailscale SSH session handling can make the root daemon run out of memory. High (denial of service).
6. headscale memory exhaustion and approval eviction without authentication, plus an unbounded read in the Tailscale DERP relay client. Medium-High (availability).
7. tailscale serve forwarding raw TCP to the local admin socket gives a remote peer access to the node's local API. High, but only if the operator sets up that forward.
8. A serve socket guard is only checked when the config loads. Medium.
9. Funnel permission is checked only by peer capability and local config. Medium. The researcher calls this a threat-model issue.
10. The TS_SERVE_ALLOW_ALL_INTERFACES setting exposes serve outside the tunnel. A configuration note: the setting is off by default and the behavior is documented upstream.
11. A race in serve's shared HTTP/2 context can leak one mount's capabilities to another. Medium, or Low-Medium.

The SSH findings (1 to 3) carry most of the risk. The researcher says the attacker needs one device already allowed by an SSH rule. So this is about moving sideways after an initial compromise, not entry from the internet.

What ThreatWire could verify

• The report exists and targets Tailscale 1.104.2 and headscale 0.29.5. Tailscale 1.104.2 (21 October 2026) is still the latest release.
• Tailscale confirms issues in Tailscale SSH around Unix privileges and forwarding. It has not confirmed the full list.
• Fix work is visible in public. Since 24 October, Tailscale has merged a series of Tailscale SSH hardening changes. Pull request #21931, merged at 00:39 UTC on 25 October, fixes the serve capability leak described in finding 11. Pull request #21937, opened on 25 October and still open, lays the groundwork for a separate privileged process to handle SSH forwarding. None of this has shipped in a release yet.
• headscale grants forwarding automatically. In headscale's SSH policy code, an "accept" rule turns on local and remote port forwarding with no option to switch it off. That matches the report.
• headscale 0.29.6 (24 October 2026) does not address Tailworm. It is a security update for Go and other dependencies (including the eMudhra certificate issue), released before the report spread.
• Related past fixes. Tailscale's bulletin TS-2026-004 (fixed in 1.98.9) covered symlinks in Tailscale SSH Unix socket forwarding. Finding 3 claims a race gets around those path checks.

What is not confirmed

• Exploitation in the wild. No source we checked reports attacks.
• The "worm" claims. Automated spread, rogue node enrollment and the Kubernetes pivots are lab results from the researcher. Tailscale has not confirmed them.
• Which configurations are affected, including whether forwarding is on by default in Tailscale's hosted service. The report and the researcher's own Hacker News comment differ on this. Tailscale says it is still checking.
• Any response from headscale's maintainers. We found none.
• Public exploit code. The report mentions reproduction kits, but we found none published. It does include some inline lab commands. ThreatWire does not reproduce them and has executed nothing.

What to do now

Tailscale's own interim advice:

1. Review your SSH access policies. Only the people and devices that need access should have it.
2. Review SSH forwarding permissions and remove any you do not need.
3. Consider SSH check mode for an extra authentication step. Tailscale notes it does not fix privilege escalation.
4. Turn on automatic updates where supported, so fixes arrive when released.
5. On sensitive systems, tighten Tailscale SSH policies for now, so only specific users and devices can connect.

Tailscale is not telling everyone to disable Tailscale SSH. If you choose to turn it off on some nodes, keep another way to reach them first.

If you run headscale, keep in mind that its SSH accept rules enable forwarding today. Grant Tailscale SSH only to users and devices you fully trust, until a fix lands.

Watch the Tailscale security bulletins for the promised advisory. We will update this article when it is out.

Related coverage

Browse the CVE tracker. No CVE has been assigned for these findings yet.

Sources: the Tailworm report, Tailscale's statement on r/Tailscale, Tailscale's security bulletins, the Hacker News discussion, the Tailscale and headscale GitHub repositories. Links are in the references list.