Your Tailscale Network Is Only as Safe as Its Weakest Device

Tailscale is one of the best things to happen to IT teams, home labs and anyone who has ever fought with a traditional VPN. Install it on two machines, sign in, and they can talk to each other from anywhere, encrypted, with no ports opened on your router. That ease is real. It is also why the Tailworm report, published on October 25, 2026, matters to far more people than the ones who read the technical details.

The report's headline finding needs only one approved device on your network and one rule that lets it in somewhere. From there, the researcher says, an attacker can become root on the next server, then the next. (We covered the flaws themselves, and what to do about them, in Tailworm: The Tailscale SSH Flaws That Let One Hacked Device Reach Root.)

The flaws will be patched. The pattern behind them won't go away on its own: a private network is only as safe as the weakest device on it.

A VPN is a hallway, not a wall

People often picture a VPN as a wall around their stuff: outsiders out, everything inside safe. A mesh VPN like Tailscale is closer to a private hallway that connects every room. Outsiders can't walk in from the street. But anyone who gets into one room can walk the hallway to every other door that isn't locked.

And by default, the doors aren't locked. Every new Tailscale network starts with a policy that, in Tailscale's own words, "lets all devices in the tailnet access all other devices in the tailnet." That is the right default for getting started, because nothing breaks. It is the wrong place to stay once your network holds anything that matters.

Why people new to Tailscale are most exposed

None of these are mistakes in Tailscale. They are the natural shortcuts of someone getting something working, and every one of them makes a single compromised device more dangerous.

• The allow-everything policy is never replaced. Your phone, your kid's gaming PC, the office printer's Raspberry Pi and your business server can all reach each other on every port.
• Everything goes on the same network. Personal laptops, family devices and work servers share one tailnet, so the least-maintained device in the house sits one hop from the most important one.
• Tailscale SSH is switched on everywhere because it is convenient. That is exactly the feature the worst Tailworm findings target.
• Key expiry is turned off so nothing ever asks you to sign in again. Tailscale's default is 180 days; turn it off and a laptop stolen next year still has access.
• Old devices are never removed. The tablet you sold, the server you retired, the VM you tested with: if they are still listed, their keys still work.
• A subnet router shares the whole local network. One setting makes every printer, camera and router admin page in the building reachable from every device on the tailnet.
• Funnel is confused with Serve. tailscale serve shares something with your tailnet. tailscale funnel puts it on the public internet, for anyone with the link.
• Services are left without passwords "because they're only on the VPN." The VPN was the only lock, and the hallway is shared.

"But I use a VPN app, not Tailscale"

Consumer VPN apps are a different tool. They hide your traffic from the network you are on, which is useful on hotel and coffee-shop Wi-Fi. They do not protect your devices, your accounts or your servers from anything already on them, and they do nothing about how your own machines trust each other. Neither kind of VPN is a substitute for patching, strong logins and access that stops where it should.

How to set it up so one device can't take everything

You do not need to be a security engineer to do most of this. Start at the top and work down.

1. Write your own access policy. Replace the allow-all rule with a short list of who may reach what, and on which port: "my laptop may reach the server on SSH", not "everyone may reach everything".
2. Tag your servers and write rules for the tags, so people's devices and machines are treated differently.
3. Keep personal and work devices apart. Use separate tailnets, or at least rules that keep family devices away from business servers.
4. Turn off what you don't use: Tailscale SSH (tailscale set --ssh=false, after making sure you have another way in), subnet routes, exit nodes, Funnel.
5. Where Tailscale SSH stays on, use check mode, so a session requires a fresh sign-in with two-factor rather than just possession of a device.
6. Leave key expiry on for laptops and phones, and turn on device approval so new devices need an admin's OK before they join.
7. Remove devices you no longer use, and delete any device you think was compromised from the admin console.
8. Keep every Tailscale client updated, not only the servers. Fixes only protect the devices that install them.
9. Lock each service as if the VPN didn't exist: passwords, keys and two-factor on everything, and nothing important left listening without a login.

The real lesson

Convenience and safety are not opposites, but they do have to be designed together. The tools that make connecting things effortless also make it effortless to connect too much. The businesses that came through reports like Tailworm calmly were the ones that had already decided, on purpose, which device may reach which.

If you've set up Tailscale or a VPN yourself and want it reviewed, or want someone to keep it patched and watched, start with our security review and hardening or get a tech quote.

Sources: Tailworm report (Cyberdione Labs); Tailscale - sample policies and the default policy; Tailscale - key expiry; Tailscale - Funnel; Tailscale - Tailscale SSH.