Tailscale SSH vulnerabilities reported by Cyberdione Labs

A security report titled ‘Tailworm’, published by researcher Erica Windisch of Cyberdione Labs, has identified 11 unpatched vulnerabilities affecting Tailscale SSH, its app connector features, the DERP relay client, and the open-source headscale server.

The most critical flaws involve race conditions and socket forwarding issues. Specifically, local and remote socket forwarding can allow an attacker to execute code with root privileges, potentially enabling a compromised device to pivot and gain root access to other servers on a private network. Other findings include memory exhaustion risks and unauthorized access to cloud metadata via app connectors.

As of the report's publication on October 25, 2026, Tailscale had not issued a CVE identifier, a security bulletin, or a software patch to address these specific findings. Because no official fix is currently available, security experts recommend that organizations tighten SSH access rules and remove any ‘tailscale serve’ configurations that forward to Unix sockets to mitigate immediate risks.