Tailworm – Tailscale Vulnerabilities

Independent researcher Erica Windisch published an audit of Tailscale v1.104.2 and headscale v0.29.5, reporting lab-reproduced flaws in five areas. The main one is Tailscale SSH: unix-socket forwarding runs as root, so an unprivileged session on a permitted device can reach root and capture enrollment keys. Other findings cover the experimental app connector, headscale denial of service, and the DERP client. The report was not coordinated with the vendor, and the claim check covered none of its claims. Per-pair SSH grants and disabling forwarding are the suggested mitigations.