Tailscale SSH Vulnerabilities (Tailworm): Update to 1.104.4 Now

If you use Tailscale SSH to reach your servers, Raspberry Pis or home lab, you should update today. A researcher published a report called Tailworm with 11 security findings, and the worst ones let an ordinary user with SSH access become root on the target machine. Tailscale has now shipped Tailscale 1.104.4 with the fixes. Here is what the Tailscale SSH vulnerabilities are, who is affected, how to check your machines and how to fix them in a few minutes.

What Are the Tailscale SSH Vulnerabilities (Tailworm)?

On October 25, 2026, Erica Windisch of Cyberdione Labs published the Tailworm report after auditing Tailscale 1.104.2 and the self-hosted control server headscale 0.29.5. She says she sent the report and proof of concept to Tailscale the day before publishing, but the disclosure was not coordinated, which caused a lot of debate.

Tailscale SSH is the SSH server built into tailscaled, the Tailscale daemon. Because the daemon runs as root, any mistake in how it handles a session can give extra power to the person connected. That is exactly what the main findings are about:

• Unix socket forwarding as root: when you forward a Unix socket over SSH (for example with ssh -L), tailscaled did the path checks and file operations as root instead of as the logged-in user. In the lab, this let a normal user reach root-only sockets, get a root shell and read /etc/shadow.
• A race condition (time of check to time of use): by swapping a path between the safety check and its use, an attacker could defeat a check that Tailscale had already added in an earlier fix (TS-2026-004, version 1.98.9).
• Memory exhaustion: repeated window-size messages in an SSH session made tailscaled grow by about 536 MB in seconds, which could crash a small server.
• tailscale serve problems: a TCP forward pointing to tailscaled’s own socket could let other machines change the device’s settings, and a race could leak app permissions between mounts.
• Other findings in an unreleased app connector feature, in the DERP relay client and in the headscale server.

The name “worm” comes from the idea that a root shell on one server could be used to jump to the next one. Tailscale describes it as lateral movement limited by your access policy, not as malware that spreads on its own.

Who Is Affected?

The key condition is that the attacker must already control a device that your SSH policy lets connect to the target. That could be a stolen laptop, a vulnerable web app on another server or a malicious package. Therefore, a broad rule like “everyone can SSH into all servers” makes the impact much bigger.

What Tailscale 1.104.4 Fixes

Tailscale published version 1.104.4 on October 28, 2026, together with the four bulletins. Its VP of Engineering, Mike Shaver, said the company was already reviewing the same code with outside specialists, and that it did not recommend that everyone disable Tailscale SSH.

How to Check If Your Machines Are Vulnerable

First, check which version each node is running:

tailscale version

Anything below 1.104.4 needs an update. Next, check whether Tailscale SSH is turned on:

tailscale debug prefs | grep RunSSH

If you see "RunSSH": true, the node runs the Tailscale SSH server and is in scope. You can also look at the Machines page of the admin console, where nodes with Tailscale SSH show an SSH badge. Finally, review the ssh section of your tailnet policy file to see who can log in where.

How to Fix It: Update to Tailscale 1.104.4

On Linux and Windows, the built-in updater is the fastest way:

sudo tailscale update
tailscale version

If you installed Tailscale from the package repository on Debian, Ubuntu or Raspberry Pi OS, you can also update it with apt:

sudo apt update
sudo apt install --only-upgrade tailscale

• macOS: update the app from the App Store or the standalone download, or run brew upgrade tailscale if you use the open-source tailscaled from Homebrew.
• Docker: pull the new tailscale/tailscale image and recreate the container. Auto-update does not survive a container restart.
• headscale users: update every client to 1.104.4. Server-side fixes for the headscale findings were still pending when this was written.

Then turn on automatic updates so the next fix installs by itself:

sudo tailscale set --auto-update

Mitigations If You Cannot Update Yet

If a machine cannot be updated right away, these steps reduce the risk. They do not replace the update.

• Disable SSH forwarding. Add TS_SSH_DISABLE_FORWARDING=1 to /etc/default/tailscaled and restart the service with sudo systemctl restart tailscaled. This keeps Tailscale SSH running but blocks the socket forwarding behind the worst findings. It also breaks SSH tunnels such as VS Code Remote SSH, and it ends open sessions.
• Narrow your SSH rules. Give each group access only to the servers it needs, and treat every SSH rule as if it grants root.
• Remove risky serve forwards. Delete any tailscale serve --tcp forward that points to a privileged Unix socket, especially /run/tailscale/tailscaled.sock.
• Use check mode ("action": "check") for sensitive servers, so users must re-authenticate before connecting.
• Turn off Tailscale SSH where you don’t need it with sudo tailscale set --ssh=false. Make sure you have another way to log in first, for example OpenSSH with SSH keys.

For example, a narrow SSH rule in your policy file looks like this:

"ssh": [
  {
    "action": "check",
    "src": ["group:admins"],
    "dst": ["tag:prod-server"],
    "users": ["autogroup:nonroot"]
  }
]

Keep in mind that limiting users to non-root accounts does not protect a server that is still on an old version, because the bug is precisely about a normal user becoming root. If you want to refresh how Linux users, groups and permissions work, see our guide to Linux file permissions.

Was Tailworm Exploited?

As of October 28, 2026, no attacks in the wild had been reported. The findings were shown in a lab, and the proof of concept was shared only with Tailscale. Some results were also less dramatic than the headlines: against the standard Docker socket, one route to root worked only 0 to 4% of the time. Still, now that the details and the fix are public, attackers can study them, so unpatched servers are an easier target every day.

If you think a device was compromised, delete it in the admin console rather than only reinstalling it, because reinstalling does not revoke a copied device key. Then rotate your auth keys and review recent policy changes in the configuration audit log.

More security news: Node2Shell (CVE-2026-111497) · iOS 27.2 security fixes.

Frequently Asked Questions

What is Tailworm?

Tailworm is the name researcher Erica Windisch of Cyberdione Labs gave to 11 security findings in Tailscale and the self-hosted headscale server, published on October 25, 2026. The most serious ones let a user who is already allowed to SSH into a machine through Tailscale SSH escalate to root on that machine.

Which Tailscale version fixes the SSH flaws?

Tailscale 1.104.4, released on October 28, 2026, fixes the issues described in security bulletins TS-2026-014 to TS-2026-017. Check your version with tailscale version and update every node that runs Tailscale SSH or tailscale serve.

Am I affected if I use normal OpenSSH over Tailscale?

No. The bugs are in Tailscale SSH, the SSH server built into tailscaled. If you only use Tailscale as a VPN and connect with the regular OpenSSH server, these flaws do not apply, although updating is still a good idea.

Can attackers exploit Tailworm from the internet?

No. An attacker first needs control of a device that your SSH policy allows to log in to the target, for example a compromised laptop. The risk is that this foothold can turn into root on your servers.

Is Tailworm being exploited in the wild?

As of October 28, 2026, no attacks in the wild had been reported. The findings were demonstrated in a lab, and the proof-of-concept code was shared only with Tailscale.

Get free security alerts

One short email when a critical vulnerability or a broken update needs your attention. No spam, unsubscribe anytime. See our privacy policy.

Please enable JavaScript in your browser to complete this form.

Email

Email *

Get free security alerts

Sources

• BleepingComputer: Tailscale warns of serious SSH flaws allowing root privilege escalation
• The Hacker News: Unpatched Tailscale SSH flaws could let hacked devices gain root
• Konfirmity: Tailworm advisory (TS-2026-014 to TS-2026-017)
• SecurityWeek: Tailscale rushes patches after uncoordinated disclosure of Tailworm flaws
• Tailscale: SSH investigation and remediation update