Tailscale fixes SSH flaws that could expose root access on servers

Tailscale has released version 1.104.4 to remediate flaws in its built‑in SSH server that could allow a trusted attacker to reach root‑level services and files on other servers. The issues stem from how Tailscale SSH forwards network connections; the Tailscale background process runs with root privileges, and exploitation requires the attacker to already control a device that is allowed by the network’s access rules to open an SSH session to the target with forwarding enabled.

The flaws were disclosed following a lab test by Erica Windisch of Cyberdione Labs, who evaluated released builds of the Tailscale client and the self‑hosted Headscale control server. Tailscale emphasises that authentication is policy‑driven rather than credential‑based, meaning an attacker does not need stolen credentials, only a foothold on a trusted device.

Tailscale’s bulletin notes four security advisories linked to this release: TS-2026-014 (SSH socket‑forwarding flaws permitting access to root‑only sockets such as the Docker socket or the tailscaled local API), TS-2026-015 (a permitted SSH session could exhaust server memory and crash the Tailscale process), TS-2026-016 (a flaw in tailscale serve enabling access to the tailscaled local API via Unix sockets, with a related socket swap issue), and TS-2026-017 (TLS serve with multiple mounts could leak another mount’s permission headers).

In tests, forwarding to the Docker control socket produced a root shell and access to /etc/shadow without administrator rights; the company states that the attack is mitigated by upgrading, or by disabling forwarding via TS_SSH_DISABLE_FORWARDING=1 if an immediate update is not possible. The bulletin also discusses broader considerations for headscale, where SSH forwarding is granted on every accepted session and cannot be turned off in policy, indicating those configurations require careful review.

Windisch’s report described the chain as “wormable” in lab conditions, though Tailscale rejects that label, clarifying movement is limited to policy‑permitted connections.