Threat feed

Tailworm — unpatched Tailscale SSH root-escalation and tailnet-escape findings

Posted · Updated · Spectrum Delta Research Team

Summary

Erica Windisch (Cyberdione Labs) published 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 on Oct 24-25, 2026, without coordinated disclosure. With Tailscale SSH enabled, root-privileged tailscaled dials root-only Unix sockets on behalf of an approved peer, so an accepted SSH rule with forwarding becomes root on the target and capture of node enrollment keys. No CVE, fix, or vendor bulletin yet; no in-the-wild exploitation reported.

Breakdown

Adversary

Unknown

Procedures (6)

  1. Tailscale SSH local Unix-socket forwarding to root-only sockets

    • T1021.004Remote Services: SSH

    Logs

    Linux auditd object-scoped socket watches; tailscaled ssh-conn session lines

Click to expand remaining (5) procedures

  1. Remote-forward BindUnlink replaces root-owned sockets

    • T1021.004Remote Services: SSH
    • T1611Escape to Host

    Logs

    Linux auditd unlink/bind watches on /run, /tmp, homes

  2. TOCTOU rename race defeats SSH path allowlist

    • T1068Exploitation for Privilege Escalation

    Logs

    auditd rename/bind/chmod watches; rename-storm rate alerting ~1e5/s; 0755 socket where 0600 expected

  3. Rogue node enrollment with captured authkey

    • T1098.005Account Manipulation: Device Registration

    Logs

    Tailscale admin console audit log/API: node joins, authkey issuance/use

  4. conn25 app connector destination bypass

    • T1552.005Unsecured Credentials: Cloud Instance Metadata API

    Logs

    K8s API server audit logs (connector-sourced requests); connector host egress logs

  5. serve --tcp forward to localapi socket (node takeover)

    • T1562.001

    Logs

    tailscaled serve config changes; localapi access

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Tailworm — unpatched Tailscale SSH root-escalation and tailnet-escape findings? Bring them to the community.

Discuss in the Tradecraft Slack