Affected Systems

Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable. Tailscale's hosted service allows per-rule forwarding controls.

Exploitation Status

No active exploitation reported. Proof-of-concept exists but is not public, shared only with Tailscale security team. Findings based on controlled lab testing by Erica Windisch (Cyberdione Labs) over three days. No independent reproduction or CVE assigned as of October 25, 2026.

Business Impact

An attacker with initial access to one device on a Tailscale network can escalate to root on other SSH-reachable servers without credentials. Lab testing demonstrated automated lateral movement in under one second per hop where access rules permit. Attack chain exploits SSH port forwarding to access root-level system sockets, bypass path validation via TOCTOU race conditions, and capture device enrollment keys. Networks without Tailnet Lock are vulnerable to attacker-controlled device enrollment. Additional findings affect experimental app connector feature (conn25), potentially exposing cloud metadata services and credentials. No patch available; Tailscale confirms investigation but has not issued security bulletin or recommended disabling Tailscale SSH broadly.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Disable Tailscale SSH port forwarding in access control policies on Tailscale hosted service; evaluate disabling Tailscale SSH entirely if using headscale 0.29.5 where forwarding cannot be disabled
  • Review and tighten Tailscale ACL rules to use least-privilege source-to-destination pairs; avoid broad network access grants that enable lateral movement
  • Enable Tailnet Lock on all Tailscale networks to prevent unauthorized device enrollment using captured keys
  • Disable experimental app connector feature (conn25) if in use until Tailscale issues guidance or patches
  • Monitor Tailscale security bulletins and upgrade immediately when patched versions become available; prior SSH vulnerabilities were fixed in version 1.98.9