Researcher Discloses 11 Unpatched Tailscale, headscale Flaws, Including an SSH Root-Access Path

On 25 October 2026, security researcher Erica Windisch of Cyberdione Labs published a report called Tailworm, listing 11 unpatched findings in Tailscale, the mesh VPN software widely used by developers and research groups to connect laptops, servers and lab machines, and in headscale, the open-source server some networks run instead of Tailscale's own hosted service. According to the report, the most serious issue is that Tailscale SSH forwards Unix-socket connections with root privileges, so a device that is already approved on a network, combined with an ordinary SSH access rule, can be used to reach root on another machine on that same network and capture enrollment keys, as described in the Tailworm report.

Windisch tested Tailscale version 1.104.2 and headscale version 0.29.5 over three days, from 22 to 24 October 2026, in a lab environment, on unmodified released software, according to the report published at tailworm.com. The 11 findings are grouped into five component classes covering Tailscale SSH's socket forwarding, the serve and Funnel features, the experimental app connectors feature, headscale's control plane, and the DERP relay client, as summarized in coverage by The Hacker News.

Beyond the root-access path through SSH, the report describes app connectors, a feature still labelled experimental by Tailscale, reaching cloud metadata endpoints and internal networks in ways that bypass the access control lists administrators set to restrict traffic, according to the Tailworm report. It also lists a path where the serve feature can forward requests into Tailscale's local API, race conditions in request handling, and ways to exhaust memory on headscale and DERP relay components, per the same report.

What the report found

The Tailworm report separates its findings by severity and component, rather than issuing a single combined score. Based on the breakdown in the Tailworm report, the findings include:

• Three findings in Tailscale SSH, rated High: a memory-exhaustion loop in its gliderssh component, a remote-forwarding socket-replacement bug, and a local-forwarding privilege-escalation bug.
• Unrestricted egress selection in app connectors, rated High, letting connected traffic reach addresses that administrators' access control lists are meant to block.
• Memory exhaustion in headscale's control plane and in the DERP relay client, both rated Medium to High.
• Five further findings in the serve and Funnel features, rated Medium to High, including a path that forwards TCP serve traffic into Tailscale's local API, race conditions in socket validation and in HTTP/2 authorization, a Funnel entitlement-enforcement gap, and one configuration note about interface-binding exposure.

Disclosure without coordination

Windisch sent the report and accompanying proof-of-concept code to Tailscale's security contact the Saturday before publishing, but did not hold the findings back for the period that coordinated disclosure norms typically allow a vendor to prepare a fix, according to the The Hacker News report on the disclosure. The published Tailworm report includes reproduction steps and proof-of-concept code for each finding. In the report, Windisch frames the decision as a trade-off: publishing quickly makes affected administrators aware sooner, at the cost of giving defenders less lead time, as described at tailworm.com.

Tailscale has responded publicly but has not issued a security bulletin, assigned a CVE identifier, or shipped a fixed release tied to these findings. According to reporting by The Hacker News, Mike Shaver, Tailscale's vice president of engineering, said the company had received the report, had already been looking at the same areas with outside security specialists, and had found issues it is now working to fix. The same report says Tailscale is still validating which configurations are affected and is not recommending that everyone disable Tailscale SSH.

What it means for developers and researchers

Tailscale is built on WireGuard and is commonly used by engineering teams, open-source projects and university labs to link machines across networks without configuring a traditional VPN or exposing ports to the public internet. The company told BetaKit that it was close to 40,000 paid business customers and had 2 million monthly active users as of July 2026, with growth driven partly by teams connecting AI agents across machines. For anyone running Tailscale SSH to reach lab servers, CI runners or shared compute, the practical takeaway from the Tailworm report is that a device already trusted on the network, not an outside attacker breaching the perimeter, is the starting point for the root-access path it describes.

Students and researchers who rely on Tailscale or headscale to reach remote servers, GPUs or shared datasets should treat SSH access rules and app connector permissions as sensitive configuration until Tailscale publishes a fix, rather than assuming the mesh network's encryption alone limits what a single compromised device can reach.

Current status

As of 26 October 2026, no CVE number, security bulletin or patched release has been published for the Tailworm findings. Tailscale's public statements, as reported by The Hacker News, say fixes are in progress but do not give a release date. Readers running Tailscale SSH or headscale in production should watch Tailscale's own security advisories page for an update rather than relying on third-party summaries of the unpatched report.