Executive Summary
A comprehensive security report titled Tailworm, released by Cyberdione Labs in October 2026, details multiple high-severity vulnerabilities in the Tailscale SSH implementation. These flaws allow attackers to escalate privileges to root and move laterally across private mesh networks in under a second per hop. The most critical findings involve Tailscale's SSH server running with root permissions, where socket forwarding can be exploited to read sensitive files like /etc/shadow or execute code as root.
The research highlights that Tailscale's architecture, which replaces standard privilege-separated OpenSSH with a unified root daemon, creates a significant attack surface. While Tailscale creates secure tunnels, these vulnerabilities demonstrate that a single compromised device can become a gateway to an entire fleet if broad access rules are in place. The report specifically notes that threat actors like Scattered Spider have previously utilized Tailscale VPN for lateral movement, emphasizing the real-world risk to enterprise environments.
As of the report date, no official CVEs or patches have been issued by Tailscale. The findings are based on laboratory testing of Tailscale version 1.104.2 and headscale 0.29.5. Organizations are urged to move away from broad identity-wide rules toward per-pair access controls to mitigate these risks.
Key Details
Threat Name
Tailworm
Affects
—
Adversary
Scattered Spider
MITRE Techniques
—
Malware/Tools
None identified