Tailworm is a security report published on 25 October 2026 by Erica Windisch of Cyberdione Labs. It lists 11 findings in Tailscale 1.104.2 and headscale 0.29.5, tested between 22 and 24 October. The most serious is that Tailscale SSH forwards Unix sockets as root, so a user allowed to open an SSH session with forwarding can reach root-only sockets on the target, such as the Docker socket, and take the machine. The report was published before a patch existed.

Is my Tailscale network affected by Tailworm?

The SSH findings matter only if you use Tailscale SSH, the feature where tailscaled itself accepts SSH sessions under your tailnet policy. If your servers run ordinary OpenSSH over Tailscale, these findings do not apply to that path. Exposure also needs an SSH rule that lets a device connect with forwarding allowed. Tailscale says exploitation depends on the permissions granted to the connecting user or device, and is still confirming which configurations are affected.

How do I mitigate Tailworm before the patch?

Tailscale recommends setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it. That disables SSH forwarding without turning Tailscale SSH off. Then narrow your SSH policy so each rule names specific source and destination devices, and update to the patched client as soon as Tailscale publishes it. Headscale 0.29.5 cannot disable forwarding per rule, so treat any SSH grant there as root access until fixed.

Is Tailworm worse than PHP2Shell?

It reaches fewer systems and does more damage per hit. PHP2Shell let anyone on the internet run code on an unpatched PHP server with one request and no login. Tailworm needs an attacker to already control a device your Tailscale policy trusts. Once they do, it turns that one device into root on every server the policy lets it SSH into, which is the access a ransomware crew needs.

Field Notes / Vulnerability

Tailworm: one trusted laptop, root on every server it can SSH into.

On 25 October 2026 a researcher published 11 findings in Tailscale and headscale, with no patch out. The worst let a device that is allowed to open a Tailscale SSH session become root on the server it connects to, then hop on. Tailscale confirmed the core issue the next day and is shipping fixes. Here is who is exposed, how it compares with PHP2Shell, and the one setting to change today.

Author: Red Team Partners
Read: 8 MIN READ
Filed: 27 Oct 2026

The finding

Tailscale SSH forwards Unix sockets as root. On 25 October 2026 researcher Erica Windisch showed what that means: a device that is allowed to open a Tailscale SSH session with forwarding can talk to the target’s Docker socket, run commands as root and read /etc/shadow GBHackers 2026 . Her report, Tailworm, lists 11 findings in Tailscale 1.104.2 and headscale 0.29.5, and went out before any patch Tailworm 2026 .

Tailscale confirmed the core of it a day later. "Most of the Tailscale SSH issues we’ve identified concern privilege escalation," its update reads, and it targeted a fixed client for 27 October Tailscale 2026 . If you use Tailscale SSH, set one environment variable today. Instructions are in chapter 4.

01 What Tailworm found

ailscale SSH lets the Tailscale daemon accept SSH sessions itself. You write a rule in the tailnet policy, say which devices may log in as which user, and tailscaled checks it. No keys to hand out. Many teams switched to it for exactly that reason. The daemon runs as root, because it has to start sessions as other users.

Windisch found that when a session asks to forward a Unix socket, the daemon opens that socket while still root. It never drops to the user the policy assigned. Three of her findings share this root cause Tailworm 2026 :

Finding	What an authorised session can do	Rating
1. `ssh -L` socket forwarding	Connect to root-only sockets, such as Docker’s, and run commands as root. No sudo or docker group needed	High
2. `ssh -R` socket forwarding	Replace root-owned sockets with a listener the attacker controls, then capture what connects to them	High
3. Race on the path check	Swap a path between check and use, defeating the allowlist meant to block sensitive sockets	High
5. Session memory pin	Drive root tailscaled into an out-of-memory loop	High
7. `serve --tcp` to the local API	Give an allowed peer write access to the node’s Tailscale configuration	High

The other six cover headscale memory exhaustion, the experimental conn25 app connector and Tailscale Serve. In her lab, Windisch chained the root access into automated movement from machine to machine, at under a second per hop GBHackers 2026 . That speed is where the name comes from.

The disclosure was not coordinated. Windisch says she sent the report and proof of concept to Tailscale’s security contact before publishing. She did not wait for a fix The Hacker News 2026 . Tailscale’s VP of Engineering, Mike Shaver, said the company was already reviewing the same areas with outside specialists. By 27 October fixes for findings 1 to 3, 5, 7 and 11 had landed in Tailscale’s public code. SSH forwarding now runs in unprivileged child processes Tailworm 2026 . As we publish, no CVE and no fixed version number exist yet.

02 Who is exposed

Tailworm does not let a stranger on the internet in. An attacker needs three things at once:

A foothold. Control of one device that is already part of your tailnet. A developer laptop with malware, a stolen auth key, a CI runner someone joined to the network.
Tailscale SSH on the target. Servers that run plain OpenSSH and only use Tailscale for the network path are outside the SSH findings.
A rule that lets the foothold in, with forwarding. On tailscale.com forwarding is on unless you turn it off. On headscale 0.29.5 you cannot turn it off per rule at all.

This is the third time in 2026 that a Tailscale SSH restriction has failed. In June, numeric user IDs bypassed the autogroup:nonroot root block. In July, usernames starting with a dash did the same on Linux. Both were fixed in 1.98.9 Tailscale bulletins . If your policy relies on "they can log in, but not as root", test that it holds. Do not assume it.

03 Bigger than PHP2Shell?

The headlines call it the bigger one. That depends on what you count.

	PHP2Shell	Tailworm
Who can attack	Anyone on the internet	Someone who already controls a trusted device
What they need	One HTTP request, no login	A Tailscale SSH rule that lets that device in
What they get	Code running on one web server	Root on every server the rule reaches, one hop at a time
Patch at disclosure	Attacks began six hours before it	None. Mitigation by config, fixes landing two days later

PHP2Shell hit far more systems, because every public PHP site was a target. Tailworm hits fewer, but each hit is worse. It sits at the second step of an intrusion, after the attacker is in, when they want to spread. Ransomware crews pay for exactly that step. An attacker who used PHP2Shell to land on a web server that is also a tailnet node now has a route to the rest.

04 What to do today

An IT lead can finish the first three items this afternoon. They cost nothing, and they hold until the patched client ships.

Today

Find out whether you use Tailscale SSH: look for "ssh" rules in your tailnet policy and for nodes started with --ssh. If neither exists, the SSH findings do not apply to you
On every node that accepts Tailscale SSH, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart tailscaled. Sessions keep working, forwarding stops
Rewrite broad SSH rules so each names specific source devices, specific destinations and a specific user. Remove any rule where a whole group may reach a whole tag
On headscale 0.29.5, treat every SSH grant as root until a fixed release ships, and keep the control plane off the open internet
Update tailscale on every node when the fixed version is published, then confirm the version in the admin console. Do not stop at the servers. The laptops are the footholds

Tailworm is a mesh VPN story. The lesson applies to any network built on trust between devices. Your exposure is set by the broadest rule in your policy and the weakest laptop it trusts. In 14 days we can show you both. You get every path from one compromised device to your servers, what each path reaches, and the rule change that closes it. Start with your Threat Map. Enterprise-grade. Not enterprise-priced.

References

Sources

Erica Windisch, Cyberdione Labs. Tailworm report. October 2026. tailworm.com
Tailscale. Tailscale SSH: Investigation and remediation update. 26 October 2026. tailscale.com
The Hacker News. Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers. October 2026. thehackernews.com
GBHackers. Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers. 26 October 2026. gbhackers.com
Tailscale. Security bulletins. tailscale.com