Tailscale SSH forwarding flaws enable wormable root escalation across policy-defined meshes

The Tailworm report from Cyberdione Labs documented six high-severity issues in version 1.104.2, four of them in Tailscale SSH. Forwarding operations executed with root privileges could be redirected past intended user restrictions, enabling credential theft and lateral movement at sub-second hops with no authentication. Lab chains demonstrated full mesh traversal once an initial device was compromised via phishing or supply-chain vectors.

Tailscale VP Mike Shaver confirmed an internal review was underway before disclosure but acknowledged the Unix privilege and SSH forwarding gaps. The vendor pushed fixes into public repositories by 27 October yet withheld a numbered release pending testing. This sequence repeats the 2023 Log4Shell pattern where rushed public reports compressed vendor response windows and forced operators into manual policy reviews rather than automated patch deployment.

Procurement records and GitHub commit timelines show Tailscale’s control plane updates lag client releases by days, creating a window where headscale-hosted deployments remain exposed. The absence of in-the-wild telemetry in both the report and vendor statements leaves open whether opportunistic scanning already targeted the wormable paths.

Rapid patch orchestration remains the decisive control; organizations that rely on manual SSH policy audits will continue to absorb the coordination tax imposed by uncoordinated disclosures.