Tailworm: The Tailscale SSH Flaws That Let One Hacked Device Reach Root

On October 25, 2026, security researcher Erica Windisch of Cyberdione Labs published Tailworm, a report describing eleven flaws in Tailscale, the mesh VPN that a great many businesses and IT teams use to reach their servers, and in headscale, the open-source server some teams run in its place. The most serious finding is simple to state: one hacked device on a Tailscale network can become root on other servers it is allowed to SSH into.

At the time of writing there is no patch, no CVE number and no Tailscale security bulletin for these findings. Tailscale has acknowledged the research and says it is investigating. That means the only protection available today is configuration. This post explains the Tailscale vulnerability in plain English: what Tailworm is, whether you are affected, and how to protect your network until a Tailscale patch ships.

What Tailscale SSH is

Tailscale normally just connects your devices. Your servers keep running their own SSH server, and Tailscale carries the connection.

Tailscale SSH is an optional feature on top of that: Tailscale's own built-in SSH server takes over port 22 on the device, and your Tailscale access policy decides who may log in, instead of SSH keys. It is convenient, which is why many teams turn it on. It is also exactly where the worst Tailworm findings live.

What is Tailworm? The Tailscale SSH vulnerability explained

The researcher tested released, unmodified software: Tailscale 1.104.2 and headscale 0.29.5, between October 22 and 24. The findings the report rates highest:

• Socket forwarding that runs as root (T3). SSH can forward a connection to a Unix socket on the server, with ssh -L. The report says Tailscale SSH opens that socket as root, not as the user who logged in. Root-only sockets are the control panels of a Linux server, so an ordinary login can end up talking to something that only root should reach.
• Reverse forwarding that replaces root's sockets (T2). With ssh -R, the report says a logged-in user can swap a socket owned by root for one they control, and then intercept or impersonate whatever used it.
• A race that defeats the path protections (TOCTOU). Tailscale checks which socket paths may be forwarded, but the report says the path can be changed between the check and the use.
• Memory exhaustion (T1), in the SSH session handling, plus separate memory-exhaustion findings in headscale that could knock devices off the network.
• The app connector feature (C1) reaching destinations it should not, including cloud metadata endpoints.
• Serve and Funnel authorization bypasses, affecting setups that publish services with tailscale serve or tailscale funnel.

The report calls the SSH chain wormable: once one machine is taken, the same trick can be repeated from that machine to the next one it can reach, at machine speed, without stolen passwords and without anyone clicking anything.

These are the researcher's lab results. Tailscale has not yet confirmed or disputed them, and the report itself does not claim any real network has been attacked.

Am I affected by the Tailscale vulnerability?

The SSH findings need two things:

1. Tailscale SSH turned on for the target server, with a policy rule that lets another device log in to it.
2. An attacker already in control of that other device. That could be a stolen laptop, a phished employee, malware on a home PC, or a forgotten Raspberry Pi that still has access.

Most of the danger comes from the second point being easier than people think. Tailscale's own default policy, the one every new network starts with, lets every device reach every other device. If one of them falls, everything it can reach is in play.

You are not exposed to the SSH findings if your servers do not run Tailscale SSH: if you use Tailscale only to carry ordinary OpenSSH connections, the flawed SSH server is not involved. The serve, funnel, app-connector and headscale findings are separate, and apply only if you use those features.

How to protect your network before a Tailscale patch

1. Find out whether you use Tailscale SSH at all

Open your tailnet policy file in the admin console and read the ssh section. Then check your servers: Tailscale SSH only runs on a device where someone switched it on with tailscale set --ssh (or tailscale up --ssh).

2. Turn it off where you do not need it

tailscale set --ssh=false

Before you run it, make sure you have another way into that machine, such as your normal OpenSSH server or a console. Tailscale warns that you can lock yourself out otherwise.

3. Narrow who can reach what

Replace broad rules ("all members can SSH to all servers", "any tagged device can reach any other") with specific pairs: this person, or this machine, to that server, on that port. The report's first recommendation is exactly this.

4. Use check mode for SSH that stays on

Tailscale's check mode makes a person sign in again, through your identity provider and its two-factor step, before an SSH session opens. A thief holding a laptop does not hold the owner's fresh login. Tailscale's own default SSH rule already uses it; rules that say "action": "accept" skip it.

5. Remove what you do not use

• Take the app connector capability off devices that do not need it.
• Review every tailscale serve and tailscale funnel setup, especially any that forwards to a Unix socket.
• Delete old devices from the network. If a device may have been compromised, delete it in the admin console: wiping the machine does not revoke keys that were already copied off it.
• Keep key expiry on, so a lost device's access ends by itself.

6. If you run headscale

Put memory limits and automatic restarts on the headscale process, and rate-limit who can register devices, until a fixed release is out.

7. Watch for the fix

Bookmark Tailscale's security bulletins. When a fixed version is published, update every device, not only the servers, and then confirm the version each one is actually running.

Tailworm questions people are asking

Is Tailscale safe to use right now?

For most people, yes, with care. The worst findings need Tailscale SSH turned on and an attacker who already controls one of your devices. If you do not use Tailscale SSH, those findings do not apply to you. Whatever you use, tighten your access rules: the default lets every device reach every other.

Is there a Tailscale patch or CVE for Tailworm?

Not yet. As of October 26, 2026, Tailscale has published no security bulletin, no CVE and no fixed version for these findings. Tailscale has acknowledged the report and advised users to review their access rules and consider SSH check mode. Watch Tailscale's security bulletins.

Am I affected if I don't use Tailscale SSH?

Not by the SSH findings, which are the most serious ones. If your servers run their own SSH server (OpenSSH) and Tailscale only carries the connection, the flawed SSH server is not involved. The other findings apply only if you use Tailscale Serve, Funnel, app connectors or headscale.

How do I disable Tailscale SSH?

Run tailscale set --ssh=false on the device. First make sure you have another way in, such as OpenSSH or a console, or you can lock yourself out.

Does Tailworm affect headscale?

Yes. The report tested headscale 0.29.5 and describes memory-exhaustion problems that could take devices offline. If you run headscale, limit its memory, supervise restarts and rate-limit device registration until a fix is released.

Can Tailworm spread like a worm?

That is what the name means. The report says that once one machine is taken, the same steps can be repeated from it to the next server it can SSH into, without passwords and without anyone clicking anything. Narrow rules stop that chain, because each machine can only reach the few servers it truly needs.

Should I stop using Tailscale?

No report so far shows a real network being attacked this way, and the fix for most setups is configuration you control today. The lesson is to stop using it with everything open to everything, not to stop using it.

What we checked

We use Tailscale across our own business, so the day after the report we checked our network: none of our machines run Tailscale SSH, and our servers are reached through their own SSH servers instead. We are reviewing our access rules and the other features in the report in the same way, and we will update our devices as soon as Tailscale ships a fix.

The bigger lesson

A private network is not the same as a safe one. Tools like Tailscale make it wonderfully easy to connect everything to everything, and that ease is exactly what turns one compromised laptop into a problem for every server it can see. We wrote more about that in Your Tailscale Network Is Only as Safe as Its Weakest Device.

If you want someone to review your Tailscale or VPN setup, close what should not be open, and keep watching for fixes like this one, start with our security review and hardening or get a tech quote.

Sources: Tailworm report (Cyberdione Labs); The Hacker News; GBHackers; Brandefense; Tailscale - Tailscale SSH; Tailscale - security bulletins. Status as of October 26, 2026.