Tailscale Readies Fix for SSH Privilege Flaws

Tailscale says flaws in Tailscale SSH, the feature that lets devices on its private networks open shell sessions with each other, are “serious security issues”. In an investigation and remediation update published on 26 October, the company said its engineers had built fixes for most of them. It is “targeting a release by the end of Tuesday 27 October, subject to successful completion of testing.”

The update follows a public report by Erica Windisch of Cyberdione Labs, published at tailworm.com, which describes 11 findings in Tailscale’s client software and in headscale, an open-source server that some organisations run in place of Tailscale’s hosted service. At the time of writing, no fixed version or CVE number had been published.

In brief

Tailscale says someone already allowed to connect over Tailscale SSH may, in some circumstances, gain “elevated privileges”.
It has fixes for most of the issues and is targeting a patched client by the end of 27 October.
The researcher says she showed the flaws could spread automatically between devices, but only in a lab.
Tailscale is “not recommending that everyone disable Tailscale SSH”, and recommends tighter access rules and turning off SSH forwarding.

What Tailscale has confirmed

Tailscale’s update does not go through the researcher’s findings one by one. It describes the problem in general terms: “Most of the Tailscale SSH issues we’ve identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.”

The company says whether a system can be attacked “depends on the permissions granted to the connecting user or device, the system’s configuration, and other conditions”, and that it is still checking which configurations are affected. “Based on our current assessment, we’re not recommending that everyone disable Tailscale SSH,” it says. Mike Shaver, Tailscale’s vice-president of engineering, had used the same words in an earlier reply on Reddit, The Hacker News reported.

Some of the work is already public. Tailscale’s GitHub repository shows fixes merged between 25 and 27 October, including one titled “add user-credential forwarding children and monitor dial/listen ops” and one that refuses “serving TCP to the tailscaled socket”. The latest numbered release on the changelog is still version 1.104.2, from 21 October. Once the patch ships, Tailscale says it will publish a security advisory listing the confirmed flaws, the affected versions and configurations, and then a technical blog post.

What the researcher says she found

Windisch says she tested unmodified Tailscale 1.104.2 and headscale 0.29.5 in a lab between 22 and 24 October. Tailscale SSH is switched off unless an administrator turns it on for a device. Its server runs inside the Tailscale background service, which has full root privileges. Her central findings concern socket forwarding: she says an ordinary session could use it to make that root-level service connect to, replace or delete sockets that only root should be able to use. In her lab, that gave root control of target servers. One chain also captured a key for enrolling new devices on the network.

The attack she describes starts with a foothold. “Tailscale does not create the foothold,” the report says. The attacker first needs one compromised device that the network’s rules allow to connect to a target, gained in ordinary ways such as a vulnerable web application or a poisoned software package. She calls the result “wormable”: “Measured in a lab: policy-granted Tailscale SSH plus class-1 findings allow automated spread to every device the policy permits — no passwords, no stolen keys, no user interaction, under a second per hop.”

Those are her claims. No other researcher has publicly reproduced the findings, The Hacker News reported, and some who read the report have questioned the “wormable” label. The other findings cover an experimental app-connector feature, the “serve” feature, the client’s connection to Tailscale’s DERP relays, and headscale itself.

What administrators can do before the patch

Tailscale’s advice for now:

Review SSH access policies so that only the users and devices that need access can connect.
Turn off SSH forwarding where it is not needed by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. The company says this “mitigates several of the more serious findings” without switching Tailscale SSH off.
Consider tightening Tailscale SSH policies temporarily on sensitive systems.
Apply the patched client as soon as it is available.

The researcher’s report adds further steps. It recommends writing SSH rules as single source-to-destination pairs, which it says was the one control that stopped the spread in testing. It also recommends turning on node-key expiry, removing app-connector permissions that are not needed, and deleting a compromised device at the control plane, because reimaging a machine does not revoke keys already copied from it. On headscale 0.29.5, the report says, forwarding cannot be switched off for each rule, so every SSH grant there should be treated as giving root access.

A trust model under pressure

The disagreement over severity is really about Tailscale SSH’s design. A standard SSH server checks each user’s password or key. Tailscale SSH instead identifies the connecting device and lets the network’s access rules decide who can open a session. That makes administration simpler. It also means one compromised device that broad rules trust can reach many others, which is the scenario Windisch tested. Her note on the site argues that replacing privilege-separated daemons such as OpenSSH with one highly privileged process removed layers of defence. Tailscale’s update does not address that argument. It describes the issues as serious but dependent on how each network is configured, and says that most networks can mitigate them before the patch.

This is also not the first problem in the same code. Tailscale’s security bulletins show earlier fixes this year for Tailscale SSH flaws, including a Unix-socket forwarding bug that let an unprivileged user reach privileged sockets, all fixed in version 1.98.9. Its most recent bulletin, on 21 October, concerned the compromised eMudhra certificate keys.

How the report reached the public is disputed too. Windisch calls the disclosure “reported but not coordinated”, according to The Hacker News, and some commenters have criticised it. A similar argument followed when unpatched Linux kernel flaws went to public mailing lists last week. Short of a patch, the practical exposure is narrower than the word “wormable” suggests. It applies only where Tailscale SSH is enabled, and only where access rules let one device reach many. Admins who have already patched similar flaws, such as Cisco’s Expressway root bug, will recognise the routine: limit access now, patch when it ships.

The next markers are the patched release, its version number, and Tailscale’s advisory saying which of the researcher’s findings it confirms.