Tailscale SSH Flaws Exposed Before Patches Ready
Nearly a dozen Tailscale SSH vulnerabilities went public before fixes were available. Root privilege escalation and credential theft confirmed as possible impact.
Morgan "airgap" ReyesDetails on nearly a dozen Tailscale SSH vulnerabilities went public before the company had patches ready. The cluster is being tracked publicly as “Tailworm.” Tailscale confirmed the disclosure was uncoordinated and has begun rushing fixes.
Confirmed impact across the vulnerability set: credential theft, server crashes, and root privilege escalation. No CVE IDs or CVSS scores published as of 15:00 UTC October 27. Impact details confirmed via Tailscale’s own advisory language, per SecurityWeek (October 27) and BleepingComputer (October 27).
What Tailscale SSH is
Tailscale SSH is an optional feature that routes SSH connections over a Tailscale mesh network without traditional key-based authentication. The feature replaces key management with Tailscale identity. Where it is enabled, a successful exploit has lateral movement potential across every device on that tailnet.
Patch Status
No fixed version numbers confirmed as of 15:00 UTC October 27. Tailscale says patches are in progress. Tailscale posts fixes to their security advisories page when available.
Disclosure circumstances
SecurityWeek reports that technical details became public over the weekend before any coordinated release date. The flaw details are now circulating with no patch available.
Analysis: Uncoordinated disclosure on a widely-deployed VPN tool with root-escalation impact puts organizations in a difficult position. The lateral movement potential through Tailscale SSH makes these flaws higher-priority than typical single-system privilege escalation bugs.
Related: Wasmtime Patches Two Critical Sandbox Escapes | Brotli Decoder Flaw Hits Node.js, Bun, Python: RCE Confirmed
Found this useful? Share it.
