Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
AI-summarised brief · reviewed before publication
Tailscale issued version 1.104.4 to remediate critical flaws in its built‑in SSH server that allowed root‑level socket forwarding. The vulnerabilities stemmed from the tailscaled background process, which performed network‑connection forwarding as root after a superficial path check; a timing attack could replace the checked path and grant access to privileged sockets such as Docker’s control socket or the tailscaled local API. Exploitation required an attacker to already control a device permitted by the network’s policy to open an SSH session with forwarding enabled, but no stolen credentials were needed. Researcher Erica Windisch of Cyberdione Labs disclosed the “Tailworm” chain, demonstrating rapid lateral movement across trusted devices and root shell acquisition. The patch changes forwarding to run under the logged‑in user and relies on OS file permissions, while Tailscale advises disabling forwarding via TS_SSH_DISABLE_FORWARDING=1, tightening access rules, and using check mode for sensitive systems. The self‑hosted headscale server remains unpatched as of the latest release.
💡 Why It Matters
- · By turning a trusted device into a conduit for root‑only sockets, the flaw enabled near‑instant lateral escalation across an organization’s zero‑trust network, forcing admins to reassess device‑based trust models.
