Security researcher Erica Windisch published findings this week describing vulnerabilities in Tailscale’s SSH implementation that could allow an attacker with control of one device on a Tailscale network to gain root access to other servers. The attack requires two conditions: Tailscale SSH configured to allow port forwarding and an attacker already controlling a device that network access rules permit to connect to a target. The research was conducted in a laboratory setting on Tailscale version 1.104.2 and headscale version 0.29.5. As of the publication date, Tailscale had not issued a security bulletin, CVE identifier, or patched version. The company’s vice president of engineering stated on Reddit that Tailscale had received the report and is working to fix the issues, though it has not recommended disabling Tailscale SSH entirely.
The researcher demonstrated three attack methods in testing, including using standard SSH port forwarding to gain root-level access, replacing root-owned sockets to enable direct command execution, and defeating safety checks through timing attacks. In controlled conditions, a single compromised device could potentially spread to every authorized device without requiring passwords or stolen keys. The report identified eleven findings overall, covering multiple Tailscale features beyond SSH. Since no patch exists, users are advised to review SSH access rules, disable port forwarding where possible, remove unnecessary app connector permissions, and implement other configuration changes to reduce risk.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
