Tailscale prepares client patch for wormable SSH flaws

Tailscale is preparing a client update to fix privilege-escalation flaws in Tailscale SSH, publicly disclosed by Cyberdione Labs under the name Tailworm. The researchers listed 11 findings affecting Tailscale client version 1.104.2 and headscale version 0.29.5, an open-source control server. Six findings were rated high severity; four involve Tailscale SSH, which uses device identity and network policy rather than passwords or keys to control access.

Cyberdione Labs says Tailscale SSH performs some forwarding operations with root privileges and that safeguards can be bypassed. An attacker who has compromised a device could target servers that device is authorised to reach, if the relevant access policy permits forwarding. In laboratory tests, the researchers gained root access to target servers and stole keys that could be used to add rogue devices.

They also demonstrated an automated, wormable attack that moved between eligible servers in under a second per hop, without user interaction. Other reported flaws could expose internal networks or cloud metadata services, bypass access rules, reveal a node’s administrative interface to remote peers, or cause denial of service. Neither Tailscale nor the researchers reported exploitation in the wild.

Tailscale said most fixes were in place and it aimed to release a patched client by Tuesday, 27 October, subject to testing. The researchers said some fixes had reached public code repositories but were not yet in a numbered release. Tailscale said it was not recommending that all customers disable Tailscale SSH; pending the patch, it advised reviewing SSH access policies and disabling forwarding where it is not needed.