#headscale

October 27, 2026

Tailworm details multiple high-severity Tailscale SSH flaws. The assessment of Tailscale v1.104.2 and headscale v0.29.5 describes authorized SSH sessions abusing unix-socket forwarding (ssh -L/-R) through race conditions and missing privilege drops to reach or replace privileged sockets such as Docker or systemd — root control, enrollment-key theft, and worm-like lateral spread. App-connector features that bypass network ACLs to reach cloud metadata are also covered (@blackorbird) (earlier coverage). @MiraZephyre notes tailscale set --ssh=false disables the feature on hosts that don't need it, with ordinary sshd on the tailnet IP still working. · Vulnerabilities & Exploits