Tailscale 1.104.4 fixes Tailworm SSH privilege flaws

Tailscale has fixed a set of flaws in Tailscale SSH and its Serve feature in version 1.104.4. The fixes follow the "Tailworm" report, which showed that one compromised device could gain root access on other machines it was allowed to reach. Tailscale published four security bulletins, TS-2026-014 to TS-2026-017, and laid out the details in a blog post dated October 28, 2026. Anyone who uses Tailscale SSH with port forwarding should update.

Tailscale is a VPN service that links a company's devices into one private network, called a tailnet. Tailscale SSH lets it handle logins to those machines instead of the usual SSH keys.

What the four bulletins fix

Bulletin	What went wrong	Who is affected
TS-2026-014	SSH Unix socket forwarding ran as root, so it could reach root-only sockets	Tailscale SSH where policy allows local or remote forwarding
TS-2026-015	Memory grew without limit in SSH sessions, which could crash tailscaled	Tailscale SSH nodes, from a logged-in, permitted session
TS-2026-016	Serve backends on Unix sockets could reach privileged sockets, including the tailscaled local API	Setups that point Serve at a Unix socket
TS-2026-017	A race in HTTP/2 Serve leaked App Capabilities headers between mounts	Serve with TLS and two or more mounts with different requirements

All four are fixed in 1.104.4 or later, according to Tailscale's bulletin index. Tailscale gave no severity rating for any of them.

A Unix socket is a local channel that programs on the same machine use to talk to each other. Some, like the Docker socket, give whoever reaches them full control of the machine.

How the attack works

The researcher behind the report is Erica Windisch of Cyberdione Labs, The Hacker News reports. She tested Tailscale 1.104.2 and headscale 0.29.5, the open-source control server, and listed 11 findings.

In her lab, three methods turned an ordinary SSH session into root access. One sent a forwarded connection through a root process to a root-only socket. Another swapped in a root-owned socket. A third raced a file-path safety check. That last chain captured an enrollment key and joined an attacker's machine as a trusted server. It only worked on networks without Tailnet Lock, a feature that makes trusted devices sign off on new ones.

Tailscale stresses the limits. Exploiting the bugs needs "an existing foothold on an authorized peer in the tailnet," with SSH allowed by policy. It says the flaws do not let an outsider log in to arbitrary Tailscale SSH servers. It calls the risk policy-limited lateral movement, not a self-spreading worm.

A disputed disclosure

The timeline came fast. Tailscale says concerns began circulating on social media on Friday, October 23, and it started investigating. It received the report on the morning of Saturday, October 24, and the researcher published it about two hours later.

Windisch told The Hacker News the report was "reported but not coordinated." She said she sent the report and a proof of concept to Tailscale first. Some researchers criticized publishing without a coordinated fix, according to The Hacker News and Brandefense.

Tailscale also reviewed a separate Serve and Funnel report with five findings. It fixed three as bugs and called two working as designed. An unreleased app connector, Conn25, has a flaw. "The stable app connectors available today are not affected," Tailscale says.

What this means for developers

Teams that run Tailscale SSH should treat this as a patch-now update. Plain network use without these features is not named as affected.

• Update clients to 1.104.4 or later. The fixes live in the client, so every node that accepts Tailscale SSH needs the new version.
• Turn off forwarding if you cannot patch yet. Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it. Tailscale SSH keeps working without forwarding.
• Tighten SSH rules. Replace broad rules with single source-to-destination grants, and never allow privileged target accounts, as The Hacker News and Brandefense advise.
• Audit Serve configs. Remove any tailscale serve forward that points at a Unix socket you do not need, especially privileged ones.
• Self-hosters, check headscale. Both outlets report that headscale 0.29.5 cannot turn forwarding off, so every SSH grant there is effectively root. The 1.104.4 client release does not change the server.
• Turn on Tailnet Lock. It blocked the final step of the enrollment-key chain in the lab, according to The Hacker News.

Tailscale's own advice is measured. "Based on our current assessment, we're not recommending that everyone disable Tailscale SSH," its October 26 update said. Patching, and then trimming who can forward what, is the safer path either way.