Tailworm Report Discloses 11 Unpatched Tailscale and headscale Flaws

A researcher published 11 unpatched flaws in Tailscale and headscale on October 25, 2026, and the most serious one could let an attacker who already controls a single approved device reach root on other servers. As of the latest reporting, no CVE, fixed version or vendor bulletin existed for any of the findings. Tailscale, a widely used mesh VPN, says it is working on fixes, which leaves administrators to tighten their own configurations in the meantime.

The report, called “Tailworm,” came from Erica Windisch of Cyberdione Labs. It went public without coordinated disclosure, so defenders had no patch to apply when it appeared. USA 24 did not independently verify how many American organizations run Tailscale or headscale, but the product’s wide adoption is why network and security teams are checking their setups now.

What the Tailscale SSH vulnerability allows

The headline finding involves Tailscale SSH port forwarding. According to InfoSec Today’s copy of the report, an attacker who already controls one approved device, and whose network rules permit a connection to a target, could reach root on that target. The attacker needs a foothold first. This is lateral movement inside a network, not an unauthenticated attack from the open internet, as ThreatTicker describes it.

The report also describes a second path. According to Startup Fortune, an attacker could capture enrollment keys and use them to add a rogue device to the network. A rogue device could then serve as the approved device the first attack needs, so the two paths can chain together.

The design of Tailscale SSH explains why the researcher treats the problem as serious. Tailscale SSH replaces OpenSSH. Windisch argues that OpenSSH splits privileges so user sessions run with the user’s rights, while the Tailscale path keeps a highly privileged process in charge.

Windisch also says the problem is not the first foothold itself. Tailscale does not create that foothold, but it can turn one small breach into wide access across a fleet of servers. A compromised developer laptop becomes far more dangerous when it sits on a network where one device can reach many machines.

Which versions are affected

The researcher ran lab tests on unmodified releases between October 22 and 24, 2026. The table below summarizes the scope as reported in the sources reviewed.

headscale is the open-source, self-hosted control server that some teams run instead of Tailscale’s hosted service. Organizations that manage their own infrastructure should review headscale deployments as closely as they review Tailscale clients. The sources reviewed do not list any affected versions beyond the two tested.

How severe the risk is and where experts disagree

Not every observer agrees on the label. Some researchers dispute the “wormable” label, while others call the root-access finding serious. Both positions rest largely on Windisch’s report, and the findings have not been independently reproduced in the sources reviewed.

Windisch’s comments to The Hacker News show where her emphasis lies. As reproduced in a republished copy of that story, she told the outlet that the SSH privilege escalation “is worrying,” while calling the app connector finding possibly more impactful for some organizations. Whether the app connector issue is in fact more significant remains unknown.

Lab results offer a more encouraging note. Access rules written as single source-to-destination pairs stopped the spread in the lab. Device keys tied to hardware such as a TPM or Secure Enclave also limited it. Administrators can apply narrow rule scoping today without waiting for a vendor patch.

How Tailscale is responding

Tailscale confirmed that it received the report and said it found issues it is fixing. At the time of reporting, though, no CVE, fixed version or bulletin had been issued. Tailscale VP Mike Shaver responded on Reddit, describing ongoing fixes and recommending policy reviews, tighter forwarding permissions and automatic updates rather than fully disabling SSH, as reported in a trending post on X. The company has not published a patch timeline, so administrators cannot yet schedule an upgrade.

The missing CVE creates a practical gap. Without an identifier, vulnerability scanners and ticketing systems have no clean record to flag, and security teams must track the issue by hand. The pattern contrasts with recent federal activity. USA 24 reported that an Arista VeloCloud Orchestrator flaw was added to CISA’s Known Exploited Vulnerabilities catalog with a patch due October 26. The Tailworm findings have no equivalent date.

Practical steps for administrators

Until fixes ship, administrators can reduce exposure with the following steps, drawn from the sources reviewed.

• Narrow SSH rules so each source can reach only the destinations it needs.
• Disable SSH port forwarding where possible.
• Treat headscale 0.29.5 SSH grants as root access and review every one of them.
• Consider disabling Tailscale SSH and App Connectors until fixes ship, a step some researchers recommend.
• Keep automatic updates on so fixes install quickly once Tailscale releases them.
• Review logs for unexpected device enrollments, since the enrollment-key path can add devices the team never approved.
• Where hardware supports it, tie device keys to a TPM or Secure Enclave.

Check Tailscale’s current documentation before changing settings. This desk did not verify the exact menu paths or policy syntax for each plan.

What to watch next

No exploitation in the wild appears in any source reviewed. The next signals will be a CVE assignment, a fixed release of the Tailscale client or headscale, a vendor bulletin, and independent reproduction of the findings. Tailscale has not confirmed the specific findings yet, so the scope could change once it does.

Secrets are the second-order risk. If an attacker reaches a server, any credentials stored there become targets. USA 24 has covered a Railway breach that may have exposed environment variables, and the same discipline applies here: assume that anything reachable from a compromised host may need rotating. Teams that update the moment a fix appears will be better placed than those that wait for the next scheduled maintenance window.