A researcher has disclosed vulnerabilities in Tailscale that can turn ordinary allowed SSH access into full root privileges on other nodes within the same network.
Erica Windisch from Cyberdione Labs described the issues in a report titled Tailworm. The findings show that a single compromised device can serve as a starting point for capturing additional servers connected through Tailscale. All tests were performed on Tailscale 1.104.2 and Headscale 0.29.5.
The primary concern centers on Unix socket redirection. Because certain operations are executed by the privileged tailscaled process, a standard SSH session gains the ability to reach resources normally restricted to root. In experiments the researcher leveraged this capability to interact with Docker and execute commands with elevated rights.
When access rules are permissive, the attack can be automated, allowing movement between authorized nodes in less than one second. More restrictive policies were shown to stop or limit propagation. The report also covers denial-of-service conditions and bypasses affecting individual components.
The author advises administrators to review their SSH policies and disable socket redirection when it is not required. For Headscale 0.29.5 she specifically notes the absence of an independent control to disable the feature.
