Version 1.104.4 of Tailscale closes a set of flaws in the company’s built-in SSH server, the most serious of which let a device already under an attacker’s control reach root-only services on other machines in the same network. The fix is out, and Tailscale’s security page marks all four related bulletins as resolved in that release or newer. No CVE identifiers have been assigned, and none of the bulletins carries a severity score. Updating is the main remedy. A narrower setting exists for anyone who cannot update at once.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Four bulletins, one release
Tailscale’s security bulletins page lists the batch as TS-2026-014 through TS-2026-017, all dated October 26, 2026. TS-2026-014 covers SSH Unix-socket forwarding that could grant peers access to root-only sockets. TS-2026-015 describes memory exhaustion in SSH session handling that can get the tailscaled process killed and cut every Tailscale connection on the node. TS-2026-016 covers the tailscale serve command, where a forward to a Unix socket could reach privileged sockets, including the local API socket the page describes as a route to full node takeover. TS-2026-017 is the mildest, a header mix-up between mounts when TLS serve has two or more of them.
The v1.104.4 release is the one that contains the fixes. The researcher who found the flaws writes that the tag dates from October 27. The oldest affected version is not stated in the bulletins or in coverage of them; the researcher tested v1.104.2. The GitHub entry itself carries no security text and sends readers to the company changelog, so the bulletins page is the authoritative list of what 1.104.4 repairs. The earlier fix for a related Unix-socket forwarding flaw, TS-2026-004, shipped in version 1.98.9 in June.
A path check, then a root-owned connection
The mechanism behind TS-2026-014 is a time-of-check, time-of-use race. When an authorized SSH session asked to forward a connection to a Unix socket, the tailscaled process validated the socket path and then opened the connection with root privileges. The Hacker News reports that an attacker could swap the path after the check passed, which defeated the rule about which sockets forwarding could reach. In the researcher’s tests, forwarding to the Docker control socket produced a root shell and exposed /etc/shadow without administrator rights. The patch changes who does the work. Forwarding now runs as the logged-in user and leans on ordinary operating-system file permissions in place of the old path check.
The foothold the attack still required
The phrase “one hacked device” carries a real precondition. An attacker first had to control a machine that the network’s access rules allow to open an SSH session to the target, with forwarding permitted. Tailscale said the flaws “don’t allow an unauthenticated attacker to connect to arbitrary Tailscale SSH servers.” The SSH server itself runs only on Linux and on the open-source macOS build.
Erica Windisch of Cyberdione Labs, who published the findings under the name Tailworm, argues the consequence is larger than the precondition suggests. She is quoted by The Hacker News saying “the mesh converts one ordinary foothold into fleet-wide privileged access at machine speed,” and her report recounts capturing enrollment keys and executing code as root on target servers during lab testing between October 22 and 24. The Hacker News reports no known exploitation in the wild, and she kept her proof-of-concept code private. Check mode, the SSH setting that asks for fresh authentication, does not help, because it guards the start of a session rather than forwarding inside one that has been approved.
A weekend report and the gaps that remain
Disclosure did not follow the usual order. Windisch described her report as “reported but not coordinated,” and Tailscale says it received the material about two hours before publication; its engineers, according to the company, were already reviewing the same code. VP of Engineering Mike Shaver wrote on Reddit that the company was “not recommending that everyone disable Tailscale SSH,” and a Tailscale update on October 27 called the privilege-escalation problems “serious security issues” and targeted a release within 24 hours. The Hacker News covered the unpatched stage before the fix landed.
The scope of the testing is part of the story. Windisch’s report says the lab work covered tailscale v1.104.2 with its embedded SSH server, serve and funnel, and the DERP client, Headscale v0.29.5, the gliderssh library, and the experimental conn25 connector, all on released software. She traces the unbounded memory growth in root-run SSH sessions to gliderssh, an upstream library, which means the root cause sits partly outside Tailscale’s own code. In her words, “These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort.”
Several items sit outside the patch. An app-connector finding concerns conn25, an unreleased experimental feature, and Tailscale says connectors in use today are unaffected. Of five serve and funnel findings, Tailscale fixed three and called two working as designed. The researcher’s report also says funnel enforcement that lives only in the command line remains open, and that a partial change for the connector issue is still a pending pull request.
Where the control server is the open-source Headscale, the picture differs. Headscale 0.29.5, released October 13, does not fix the reported issues, and Windisch advises treating every SSH grant on Headscale as the equivalent of root until that changes.
For servers that may already have been touched, the update does not finish the job. A stolen device key stays valid until the device is deleted at the control plane, and reimaging alone does not revoke copied keys, a point the Tailworm report makes and that Tailscale’s notices do not cover. The June fix in 1.98.9 shows the class of bug was already known to the codebase.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
