A researcher says one hacked device on a Tailscale network could give an attacker full control of other servers. No fix exists yet, so settings matter now.
A security researcher says a single hacked device on a Tailscale network can be used to take full control of other servers on that network. Tailscale connects devices into a private network. The attack targets its SSH feature, which lets people open remote sessions on servers. There is no patch yet, so the only defense for now is how the feature is set up.
Erica Windisch of Cyberdione Labs published the report, called Tailworm, on October 25. It lists 11 findings. The one getting the most attention involves Tailscale SSH with port forwarding turned on. In lab tests, an ordinary session let her reach "root," the all-powerful level of control on a server. The report says one test captured a key used to enroll new devices, then used it to add her own machine to the network as a trusted server.
She calls the result "wormable," meaning it could spread from device to device on its own. In the lab, it moved in under a second per step with no passwords, no stolen keys and no user action. That spread was measured in a lab, not seen on real networks.
The attack needs two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's rules let connect to the target. Tailscale does not create that first foothold. The report says attackers can get one the usual ways, such as a vulnerable web app, a poisoned software package, phishing or stolen logins.
Networks that run headscale, a self-hosted server some teams use instead of Tailscale's hosted service, are in a tougher spot. On version 0.29.5, forwarding cannot be turned off.
Teams that do not use Tailscale SSH are not in the path of this finding. The report also names two things that held the spread back in the lab: access rules written as single source-to-destination pairs, and device keys tied to hardware such as a TPM or Secure Enclave. On networks with Tailnet Lock enabled, the final step of the enrollment-key attack was not completed.
Much is unproven. The findings rest on Windisch's report alone. No other researcher has publicly reproduced them, her proof-of-concept code is not public, and Tailscale has not confirmed the specific technical claims. Some researchers have questioned the "wormable" label, while others call the root-access finding serious. The testing used Tailscale 1.104.2 and headscale 0.29.5.
Tailscale has said it received the report, had already been looking at the same areas with outside specialists, and found issues it is working to fix. Mike Shaver, its vice president of engineering, said the company is still working out which setups are affected. He said it is "not recommending that everyone disable Tailscale SSH." There is no security bulletin, CVE identifier or fixed version so far.
The alert box above lists the settings to check. In short, find out whether your network uses Tailscale SSH with forwarding allowed, and tighten it where you can.
Watch for a Tailscale security bulletin and a fixed version. The dispute over how the report was disclosed may also continue. Windisch says she sent Tailscale the report and code the Saturday before posting. Some critics online still call the publication irresponsible.
If your team uses Tailscale SSH, check whether port forwarding is allowed and tighten your rules now, because no patch exists yet.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
