Tailscale SSH 1.104.4 fixes root-level forwarding flaws
Tailscale SSH, a Secure Shell service for remote system access, has received security fixes for flaws that could let a compromised but trusted device reach files and services reserved for the root administrator. Version 1.104.4 addresses the issues by changing how forwarded connections are handled inside the built-in SSH server.
Exploitation requires an attacker to control a device that the network policy already permits to start an SSH session with the target. The applicable access rule must also allow forwarding, which lets a session carry a connection to another local service. Tailscale says the flaws do not give an unauthenticated attacker access to arbitrary servers, and the attacker remains limited to machines permitted by the policy file. However, Tailscale SSH uses the device's identity and network policy rather than an SSH password or key, so no additional credentials are needed after a trusted device has been compromised.
The findings came from Tailworm, a Cyberdione Labs report based on laboratory testing of released Tailscale client versions and headscale, the self-hosted control server. The Tailscale SSH server runs on Linux and the open-source macOS build, although the device initiating the malicious session can use any platform.
The main problem involved forwarding connections to a Unix socket, a local connection point that programs use to communicate on the same machine. The Tailscale background process first checked the requested socket path, then completed the operation with root privileges. By changing the path at the right moment after the check, an attacker could redirect the connection to a different socket and bypass the intended restriction.
Cyberdione Labs reported that its tests reached the Docker control socket, obtained a root shell and read /etc/shadow, the system file containing protected password information, without administrator privileges. Tailscale's bulletin describes access to root-only sockets including the Docker socket and the local tailscaled application programming interface (API), which software uses to control the service. In version 1.104.4, forwarding runs as the logged-in user instead of root, while the operating system's file permissions decide which sockets that user may access.
The release addresses four security bulletins. TS-2026-014 covers the SSH socket-forwarding weaknesses that exposed privileged sockets. TS-2026-015 concerns a permitted SSH session consuming enough memory to crash the Tailscale process, which would stop all Tailscale networking on that node. TS-2026-016 affects tailscale serve, where forwarding to a Unix socket could reach the local tailscaled API and provide remote control of the node; it also includes a related path-swapping issue. TS-2026-017 affects Transport Layer Security (TLS) serve configurations with two or more mounts, where a request could receive permission headers belonging to another mount.
Administrators using Tailscale SSH should install version 1.104.4 or later. Where an immediate update is not possible, Tailscale recommends setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. This disables forwarding without turning off Tailscale SSH and blocks several of the more serious findings. Administrators should also narrow SSH access rules to the users and devices that genuinely require access.
Tailscale additionally suggests SSH check mode for sensitive systems. This requires the user to sign in again before the session begins, but it does not prevent the forwarding flaws because forwarding occurs after an approved session has started. If compromise may already have occurred, the Tailworm report warns that updating or reimaging the machine is insufficient on its own. A stolen device key remains usable until the device is deleted through the control plane, the system used to manage participating devices. Tailscale's notices do not address that scenario.
The headscale situation remains unresolved in the versions tested. According to Cyberdione Labs, every accepted headscale SSH session receives forwarding rights, and policy cannot disable them. The report therefore says each headscale SSH permission should be treated as effectively granting root access. Headscale 0.29.5, released October 13, does not fix the reported problems.
Cyberdione Labs described the chain as wormable after tests in which one compromised device reached every policy-permitted device without passwords, stolen SSH keys or user interaction, taking under one second for each step. Pairing access rules to individual device-to-device connections stopped that movement in the tests. Binding device identities to hardware such as a Trusted Platform Module (TPM), a security component inside a device, also prevented a stolen identity from being reused elsewhere.
Tailscale disputes the worm description because the findings do not involve self-replicating malware spreading independently. It characterises the behaviour as lateral movement constrained by existing network policy, while acknowledging serious privilege-escalation issues and saying it reproduced the principal findings. The company was still determining exactly which configurations were affected.
At publication, the four bulletins had no CVE identifiers, severity scores or stated earliest affected versions. The broader Tailworm report also examined app connectors and the serve and funnel features. Tailscale says the app-connector issue applies to conn25, an experimental feature that has not been released, and not to connectors currently used by customers. Of five serve and funnel findings, the company fixed three and said the remaining two behave as designed.
The disclosure was not coordinated in advance. Tailscale says it received the report on Saturday, October 24, around two hours before publication, although its engineers were already examining the same code areas. Neither Tailscale nor Cyberdione Labs has reported exploitation in real attacks. Proof-of-concept code is not public and, according to the report, was provided only to Tailscale's security team. A separate Unix-socket forwarding flaw that allowed an unprivileged user to reach a privileged socket was fixed in June in version 1.98.9.
For organisations reviewing server access and infrastructure, AEU-I offers security-first IT, infrastructure and consulting. The immediate priorities remain installing 1.104.4 or later, restricting trusted device relationships and removing any potentially stolen device identity from the control plane.