{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-A1BC7BF0",
  "slug": "tailscale-tailworm-ssh-root-escalation-ts-2026-014-upgrade-1-104-4",
  "title": "Tailworm: Tailscale SSH socket forwarding gave a trusted device root on the servers it could reach (TS-2026-014, fixed in 1.104.4)",
  "aliases": [
    "Tailworm",
    "Tailscale Tailworm",
    "TS-2026-014",
    "TS-2026-015",
    "TS-2026-016",
    "TS-2026-017",
    "Tailscale SSH root escalation",
    "Tailscale 1.104.4 security fix",
    "Cyberdione Labs Tailworm"
  ],
  "summary": "Tailworm is the name Cyberdione Labs gave to 11 findings in Tailscale 1.104.2 and headscale 0.29.5, published on 2026-10-25 before any patch existed. The most serious (Tailscale bulletin TS-2026-014) is in Tailscale SSH: Unix socket forwarding (ssh -L and ssh -R) validated paths by name but performed dial, bind and unlink as the root tailscaled process, and a race defeated the path allowlist. A device already permitted by an SSH rule could reach root-only sockets such as the Docker socket or the tailscaled local API and gain root on the target; in the researcher's lab the chain spread host to host in under a second per hop. Tailscale also bulletined SSH session memory exhaustion (TS-2026-015), tailscale serve Unix backends reaching the local API (TS-2026-016) and an HTTP/2 capability bleed across serve mounts (TS-2026-017). Tailscale 1.104.4, tagged 2026-10-27, fixes all four by running forwarding as the session user, bounding session memory and rechecking serve targets on every dial. Headscale control-server findings and part of the app connector finding are not fixed by the client release.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "No CVE IDs were published at the time of writing; Tailscale bulletin IDs are the identifiers. The wormable spread was measured in a lab, and neither Tailscale nor the report mentions exploitation in the wild. Tailscale does not publish a CVSS score in the bulletins. Package repositories and app stores may lag the GitHub release.",
  "firstObservedAt": "2026-10-25T00:00:00Z",
  "lastObservedAt": "2026-10-28T01:05:26Z",
  "publishedAt": "2026-10-28T01:23:48.288Z",
  "reviewedAt": "2026-10-28T01:23:40.005Z",
  "expiresAt": "2026-10-28T01:05:26Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "tailscale-bulletins",
      "label": "Tailscale security bulletins TS-2026-014 to TS-2026-017",
      "url": "https://tailscale.com/security-bulletins",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-26T00:00:00Z"
    },
    {
      "id": "tailscale-update",
      "label": "Tailscale SSH: Investigation and remediation update",
      "url": "https://tailscale.com/ssh-investigation-update",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-26T00:00:00Z"
    },
    {
      "id": "tailscale-release",
      "label": "Tailscale v1.104.4 release",
      "url": "https://github.com/tailscale/tailscale/releases/tag/v1.104.4",
      "sourceType": "other_primary",
      "observedAt": "2026-10-28T01:05:26Z"
    },
    {
      "id": "tailscale-compare",
      "label": "Tailscale commits v1.104.2 to v1.104.4",
      "url": "https://github.com/tailscale/tailscale/compare/v1.104.2...v1.104.4",
      "sourceType": "other_primary",
      "observedAt": "2026-10-27T22:46:01Z"
    },
    {
      "id": "tailworm-report",
      "label": "Tailworm: Security assessment of Tailscale v1.104.2 and headscale v0.29.5 (Cyberdione Labs)",
      "url": "https://tailworm.com/",
      "sourceType": "research",
      "observedAt": "2026-10-25T00:00:00Z"
    },
    {
      "id": "bleepingcomputer",
      "label": "BleepingComputer: Tailscale warns of SSH flaws allowing root privilege escalation",
      "url": "https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/",
      "sourceType": "research",
      "observedAt": "2026-10-27T14:09:46Z"
    },
    {
      "id": "thn",
      "label": "The Hacker News: Tailscale SSH flaws could let a hacked device reach root on other servers",
      "url": "https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html",
      "sourceType": "research",
      "observedAt": "2026-10-25T17:44:09Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Tailworm turns one hacked laptop into root on your Tailscale SSH servers",
      "url": "https://hol.org/blog/tailscale-tailworm-ssh-root-escalation-ts-2026-014-upgrade-1-104-4",
      "sourceType": "other_primary",
      "observedAt": "2026-10-28T01:17:57Z"
    }
  ],
  "artifacts": [
    {
      "id": "tailscale-client",
      "artifactClass": "package",
      "ecosystem": "other",
      "name": "Tailscale client (tailscaled)",
      "version": "<1.104.4 (tested vulnerable: 1.104.2; fixed in 1.104.4)",
      "defanged": false
    },
    {
      "id": "headscale",
      "artifactClass": "package",
      "ecosystem": "go",
      "name": "headscale (juanfont/headscale)",
      "version": "<=0.29.6 per Tailworm report (control-server findings, not fixed by Tailscale 1.104.4)",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "tailworm-report-published",
      "occurredAt": "2026-10-25T00:00:00Z",
      "eventType": "disclosure",
      "summary": "Cyberdione Labs publishes the Tailworm report covering 11 findings in Tailscale 1.104.2 and headscale 0.29.5 before any fix ships.",
      "sourceIds": [
        "tailworm-report",
        "thn"
      ]
    },
    {
      "id": "tailscale-investigation-update",
      "occurredAt": "2026-10-26T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "Tailscale publishes an SSH investigation update, recommends TS_SSH_DISABLE_FORWARDING=1 and targets a patched client by end of 2026-10-27.",
      "sourceIds": [
        "tailscale-update",
        "bleepingcomputer"
      ]
    },
    {
      "id": "tailscale-1-104-4-release",
      "occurredAt": "2026-10-28T01:05:26Z",
      "eventType": "vendor_action",
      "summary": "Tailscale publishes the v1.104.4 GitHub release and security bulletins TS-2026-014 to TS-2026-017.",
      "sourceIds": [
        "tailscale-release",
        "tailscale-bulletins"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-tailscale",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not inspect Tailscale SSH sessions or tailnet policy; the fix is the 1.104.4 upgrade plus tighter SSH rules. Guard can reduce the chance a developer laptop becomes the first foothold by pausing risky agent installs and commands."
    }
  ],
  "policies": [],
  "limitations": [
    "Nodes that run neither Tailscale SSH nor tailscale serve with Unix socket backends are not affected by TS-2026-014 or TS-2026-016",
    "Servers reached with regular OpenSSH over the tailnet are not affected by the Tailscale SSH forwarding findings",
    "Plain WireGuard mesh traffic between nodes is not part of these findings",
    "With Tailnet Lock enabled the lab chain could not finish enrolling a rogue node, though root on the target was still reached",
    "Headscale control-server memory exhaustion findings and part of the app connector egress finding are not fixed by Tailscale 1.104.4"
  ],
  "correctionHref": "/guard/security/campaigns/tailscale-tailworm-ssh-root-escalation-ts-2026-014-upgrade-1-104-4/corrections"
}