Unpatched Tailscale SSH Flaws Allow Root Access via Compromised Devices

• •Unpatched Tailscale SSH vulnerabilities allow root access via compromised devices.
• •Attack requires Tailscale SSH with port forwarding enabled and an existing foothold on one device.
• •Tailscale has not issued a patch or CVE identifiers as of the report's publication.

A security report published on October 25, 2026, reveals unpatched vulnerabilities in Tailscale SSH that could enable attackers to gain root access on multiple servers through a single compromised device. The researcher, Erica Windisch from Cyberdione Labs, tested Tailscale version 1.104.2 and headscale version 0.29.5, identifying multiple attack vectors that exploit the SSH server's design. The attack requires Tailscale SSH to allow port forwarding and an attacker to already control one device within the network. Tailscale has acknowledged the report and is investigating the issues but has not yet issued a security bulletin or patch. The report outlines that the flaws could be exploited without needing stolen credentials, relying instead on existing access rules. The vulnerabilities affect both Tailscale's hosted service and self-hosted headscale setups, with implications for network administrators. As of now, no CVE identifiers have been assigned, and the company is still assessing the impact on various setups.