Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [ACTIVE] · [TECHNOLOGY]
2 clusters · 8 sources · 2 days · First seen · Last updated
Tailscale Tailworm security vulnerabilities
Overview
On October 25, 2026, researcher Erica Windisch of Cyberdione Labs published a report titled ‘Tailworm’, identifying 11 unpatched vulnerabilities affecting Tailscale SSH, app connector features, the DERP relay client, and the open-source headscale server. The report highlighted critical flaws involving race conditions and socket forwarding that could allow attackers to execute code with root privileges and pivot through private networks. At the time of publication, Tailscale had not issued a CVE identifier or a software patch.
By October 27, 2026, Tailscale announced it was preparing client updates to address the vulnerabilities, which affect Tailscale version 1.104.2 and headscale version 0.29.5. Six of the 11 findings were rated as high severity. Researchers noted that the SSH flaws were ‘wormable’, meaning automated attacks could move between servers in under a second per hop without user interaction. The vulnerabilities also posed risks of remote code execution, server crashes, and credential theft.
Entities
Tailscale · headscale · Cyberdione Labs · Uganda National CERT and Coordination Center · Erica Windisch
Timeline
-
[TECHNOLOGY] 4 sourcesTailscale prepares patches for ‘Tailworm’ security vulnerabilities
Tailscale is rushing patches for ‘Tailworm’, a set of 11 vulnerabilities including wormable SSH flaws that could allow attackers to gain root access and move across networks without user interaction.
-
[TECHNOLOGY] 5 sourcesTailscale SSH vulnerabilities reported by Cyberdione Labs
Security researcher Erica Windisch has identified 11 unpatched vulnerabilities in Tailscale SSH and networking components that could allow attackers to gain root access across connected servers.
Sources
blogspan.net · cert.ug · cybernoz.com · gamemag.it · it-connect.fr · pcper.com · spacemoney.com.br · thecyberexpress.com