Researcher reports 11 unpatched Tailscale flaws, says SSH forwarding can yield root in lab tests

As of 2:54 p.m. ET, Oct. 25, 2026

A security researcher has published a report describing 11 unpatched flaws in Tailscale and the self-hosted headscale control server, including lab tests in which Tailscale SSH with port forwarding enabled let one approved device obtain root access on other servers it could reach, according to the report and trade coverage Sunday.

Erica Windisch of Cyberdione Labs posted the findings as “Tailworm” at tailworm.com. The report says testing ran Oct. 22–24 on Tailscale version 1.104.2 and headscale version 0.29.5. Windisch’s account has not been independently reproduced in public, and Tailscale has not confirmed the specific technical claims, The Hacker News reported.

In Windisch’s telling, the highest-impact scenario for typical users involves Tailscale’s built-in SSH feature when forwarding is allowed: an attacker who already controls one policy-approved device can, she says, escalate to root on other reachable hosts and, in some lab configurations, capture enrollment material. The report and The Hacker News both stress that Tailscale does not create that first foothold. On Tailscale’s hosted service, forwarding can be turned off per rule; on headscale 0.29.5, Windisch says forwarding cannot be disabled, so every SSH grant should be treated as root-equivalent until fixed.

Windisch has described the overall result as “wormable.” Other researchers who read the report have publicly questioned that label, The Hacker News reported. No attacks in the wild were reported in the material reviewed for this story.

Tailscale had issued no security bulletin, no CVE identifier and no fixed release tied to the report as of Sunday, according to The Hacker News and Tailscale’s public bulletins page. Mike Shaver, Tailscale’s vice president of engineering, wrote on Reddit that the company had received the report, had already been examining the same areas with outside specialists, and is working on fixes, The Hacker News and The Block reported. Shaver said Tailscale is “not recommending that everyone disable Tailscale SSH,” and that the issues concern behavior after a connection is authorized — “isn’t the same as an unauthenticated attacker being able to connect to arbitrary machines,” The Block quoted. In a reply, he said the flaws affect Tailscale’s own SSH feature, not ordinary SSH run over a Tailscale connection, and that the company plans to publish a security advisory with patches, according to The Block.

Windisch wrote that the work was “reported but not coordinated,” The Hacker News said, citing her comment on Hacker News. The Hacker News said it had contacted Tailscale and Windisch with questions.

What is not known

Independent researchers have not publicly reproduced Windisch’s findings, and Tailscale has not confirmed each claimed bug. Which production setups are affected, and when patches will ship, remain unclear beyond Shaver’s statement that an advisory is planned. There is no public CVE and no Tailscale bulletin for this report yet.