Tailscale SSH Port Forwarding Enables Root Lateral Movement Without Credentials

Erica Windisch's Tailworm report documented three distinct escalation paths on Tailscale 1.104.2 and headscale 0.29.5. Standard SSH forwarding allowed an unprivileged process to trigger root-owned socket connections, read /etc/shadow, and replace sockets for direct command execution. A TOCTOU race on file paths bypassed access checks and captured enrollment keys when Tailnet Lock was absent, enabling an attacker-controlled node to join as trusted. These steps succeeded only when access rules permitted the initial connection and forwarding remained active.

The findings expose a systemic pattern in mesh VPN designs where identity-based rules replace per-user authentication. Similar issues appeared in earlier WireGuard and ZeroTier deployments where port forwarding interacted with privileged daemons. Tailscale's hosted service permits per-rule forwarding disablement while headscale 0.29.5 does not, creating inconsistent exposure across deployments. Procurement records from defense contractors show growing Tailscale adoption for enclave connectivity, amplifying the blast radius if initial footholds occur through typical supply-chain vectors.

Tailscale VP Mike Shaver confirmed internal review but issued no CVE or bulletin. Independent researchers noted the root-access vector is serious while disputing automatic wormability, as tightly scoped rules and hardware-bound device keys block spread. No real-world exploitation has been confirmed. Next steps include targeted rule audits and hardware attestation enforcement before any vendor patch reaches stable release.