Cyber Security News on X: "‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access ...

X • October 25, 2026

Cyber Security News @The_Cyber_News ‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers Details: cybersecuritynews.com/tailscale-ssh-… A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups. They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks. The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine. #cybersecuritynews 2:19 PM · Oct 25, 2026 · 69.7K Views 19

srikanth talloju @tuffbrownboy 1h Stopgap until there's a fix: tailscale set --ssh=false on any box that doesn't need it, and grep your ACL ssh rules for users: ["root"] or autogroup:nonroot wide open. Anyone actually running Tailscale SSH on prod hosts?

Obsvra @Obsvra 1h Note this requires a compromised device (root access) on a machine on the Tailnet. Serious, but not hair-on-fire time. Use lock to prevent unauthorized devices being added and keep your devices patched.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Unpatched Tailscale SSH Flaws Allow Root Access via Compromised Devices A security report published on October 25, 2026, reveals unpatched vulnerabilities in Tailscale SSH that could enable attackers to gain root access on multiple servers through a single compromised device. The researcher, Erica Windisch from Cyberdione Labs, tested Tailscale version 1.104.2 and headscale version 0.29.5, identifying multiple attack vectors that exploit the SSH server's design. The attack requires Tailscale SSH to allow port forwarding and an attacker to already control one device within the network. Tailscale has acknowledged the report and is investigating the issues but has not yet issued a security bulletin or patch. The report outlines that the flaws could be exploited without needing stolen credentials, relying instead on existing access rules. The vulnerabilities affect both Tailscale's hosted service and self-hosted headscale setups, with implications for network administrators. As of now, no CVE identifiers have been assigned, and the company is still assessing the impact on various setups. 3 sources 40

Extracted Entities

Cyber Security News on X: "‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access ...

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Tools (3)