Tailscale said Monday it is investigating privilege-escalation bugs in Tailscale SSH and targeting a patched client by the end of Tuesday, Oct. 27, after researchers reported a cluster of issues in lab tests of recent software^1,2.

Cyberdione Labs founder Erica Windisch said the team found 11 flaws, collectively labeled Tailworm, in Tailscale 1.104.2 and the self-hosted headscale control server 0.29.5, and that the findings were reproduced on unmodified released builds^1,2.

BleepingComputer reported the most severe finding involves Tailscale SSH, an embedded SSH server that can run as root, and unix-socket forwarding that can let an already approved session replace, dial or delete privileged resources¹.

The Hacker News said the path described in the research would require Tailscale SSH with port forwarding enabled and an attacker who already controls a device that access rules allow to reach the target².

Tailscale said most of the SSH issues it has identified concern privilege escalation, and that in some cases a user already authorized to connect over Tailscale SSH may be able to act beyond their configured local user, including potentially gaining elevated privileges^1,2.

The company called the issues serious, said exploitation depends on granted permissions, system configuration and other conditions, and said it is still verifying scope^1,2.

While preparing a fix, Tailscale recommended reviewing SSH access policies, tightening access to sensitive systems, and disabling SSH forwarding if it is not needed by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and restarting the service¹.

The Hacker News noted that when the research first appeared, Tailscale had issued no security bulletin or CVE and no fixed version, and that the write-up described lab tests rather than attacks on real networks².

Tailscale said it plans a security advisory with confirmed vulnerabilities, affected versions and configurations after the patch ships, followed by a technical write-up^1,2.