Tailworm: Tailscale SSH socket forwarding gave a trusted device root on the servers it could reach (TS-2026-014, fixed in 1.104.4)
Direct answer
Tailworm: Tailscale SSH socket forwarding gave a trusted device root on the servers it could reach (TS-2026-014, fixed in 1.104.4), also tracked as Tailworm / Tailscale Tailworm / TS-2026-014 is a high-severity threat campaign HOL Guard tracked from Oct 25, 2026 to Oct 28, 2026, verified against 8 primary sources and last reviewed Oct 28, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Tailworm is the name Cyberdione Labs gave to 11 findings in Tailscale 1.104.2 and headscale 0.29.5, published on 2026-10-25 before any patch existed. The most serious (Tailscale bulletin TS-2026-014) is in Tailscale SSH: Unix socket forwarding (ssh -L and ssh -R) validated paths by name but performed dial, bind and unlink as the root tailscaled process, and a race defeated the path allowlist. A device already permitted by an SSH rule could reach root-only sockets such as the Docker socket or the tailscaled local API and gain root on the target; in the researcher's lab the chain spread host to host in under a second per hop. Tailscale also bulletined SSH session memory exhaustion (TS-2026-015), tailscale serve Unix backends reaching the local API (TS-2026-016) and an HTTP/2 capability bleed across serve mounts (TS-2026-017). Tailscale 1.104.4, tagged 2026-10-27, fixes all four by running forwarding as the session user, bounding session memory and rechecking serve targets on every dial. Headscale control-server findings and part of the app connector finding are not fixed by the client release.
Also tracked as Tailworm · Tailscale Tailworm · TS-2026-014 · TS-2026-015 · TS-2026-016 · TS-2026-017 · Tailscale SSH root escalation · Tailscale 1.104.4 security fix · Cyberdione Labs Tailworm
- First observed
- Oct 25, 2026
- Last observed
- Oct 28, 2026
- Last reviewed
- Oct 28, 2026
- Tracking ended
- Oct 28, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
No CVE IDs were published at the time of writing; Tailscale bulletin IDs are the identifiers. The wormable spread was measured in a lab, and neither Tailscale nor the report mentions exploitation in the wild. Tailscale does not publish a CVSS score in the bulletins. Package repositories and app stores may lag the GitHub release.
- Nodes that run neither Tailscale SSH nor tailscale serve with Unix socket backends are not affected by TS-2026-014 or TS-2026-016
- Servers reached with regular OpenSSH over the tailnet are not affected by the Tailscale SSH forwarding findings
- Plain WireGuard mesh traffic between nodes is not part of these findings
- With Tailnet Lock enabled the lab chain could not finish enrolling a rogue node, though root on the target was still reached
- Headscale control-server memory exhaustion findings and part of the app connector egress finding are not fixed by Tailscale 1.104.4
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
Not covered, or partially covered
not covered
HOL Guard reviews AI coding agent actions on developer machines. It does not inspect Tailscale SSH sessions or tailnet policy; the fix is the 1.104.4 upgrade plus tighter SSH rules. Guard can reduce the chance a developer laptop becomes the first foothold by pausing risky agent installs and commands.
No campaign-specific policy guidance is published.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
Cyberdione Labs publishes the Tailworm report covering 11 findings in Tailscale 1.104.2 and headscale 0.29.5 before any fix ships.
Sources:Tailworm: Security assessment of Tailscale v1.104.2 and headscale v0.29.5 (Cyberdione Labs)·The Hacker News: Tailscale SSH flaws could let a hacked device reach root on other servers
- Vendor action
Tailscale publishes an SSH investigation update, recommends TS_SSH_DISABLE_FORWARDING=1 and targets a patched client by end of 2026-10-27.
Sources:Tailscale SSH: Investigation and remediation update·BleepingComputer: Tailscale warns of SSH flaws allowing root privilege escalation
- Vendor action
Tailscale publishes the v1.104.4 GitHub release and security bulletins TS-2026-014 to TS-2026-017.
Sources:Tailscale v1.104.4 release·Tailscale security bulletins TS-2026-014 to TS-2026-017
Publication clock: 73.4 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
Tailscale client (tailscaled)@<1.104.4 (tested vulnerable: 1.104.2; fixed in 1.104.4)otherpackageheadscale (juanfont/headscale)@<=0.29.6 per Tailworm report (control-server findings, not fixed by Tailscale 1.104.4)gopackage
Sources
Every claim on this record is traceable to the sources below.
- Tailscale security bulletins TS-2026-014 to TS-2026-017vendor advisory · observed October 26, 2026
- Tailscale SSH: Investigation and remediation updatevendor advisory · observed October 26, 2026
- Tailscale v1.104.4 releaseother primary · observed October 28, 2026
- Tailscale commits v1.104.2 to v1.104.4other primary · observed October 27, 2026
- Tailworm: Security assessment of Tailscale v1.104.2 and headscale v0.29.5 (Cyberdione Labs)research · observed October 25, 2026
- BleepingComputer: Tailscale warns of SSH flaws allowing root privilege escalationresearch · observed October 27, 2026
- The Hacker News: Tailscale SSH flaws could let a hacked device reach root on other serversresearch · observed October 25, 2026
- HOL: Tailworm turns one hacked laptop into root on your Tailscale SSH serversother primary · observed October 28, 2026
Campaign questions, answered
Tailworm is the name Cyberdione Labs gave to 11 findings in Tailscale 2 and headscale HOL Guard tracked the campaign from Oct 25, 2026 to Oct 28, 2026.
No. Active tracking ended Oct 28, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 8 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 28, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. No CVE IDs were published at the time of writing; Tailscale bulletin IDs are the identifiers. The wormable spread was measured in a lab, and neither Tailscale nor the report mentions exploitation in the wild.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-A1BC7BF0