Tailscale SSH flaw allows root access expansion from compromised devices

# Tailscale SSH flaw allows root access expansion from compromised devices

https://gcdradar.vercel.app/incidents/tailscale-ssh-flaw-allows-root-access-expansion-from-comprom · AIR-2026-1525 · closed 2026-11-08

- Lane: Research
- Severity: 1 (Research / proof of concept): Demonstrated by researchers with no known real-world exploitation.
- Fix status: Fix status unknown
- First reported: 2026-10-25
- AI role: No AI role
- Products: Tailscale SSH

## Summary

A researcher published findings revealing that a single compromised device on a Tailscale network can achieve root access on other reachable servers. The attack vector requires Tailscale SSH port forwarding enabled and permissive network access rules.

## What to do

Apply the latest Tailscale updates that include the SSH fixes

## Affected and fixed versions

- Affected: Tailscale SSH
- Fixed in: 1.104.4

## Latest updates

- 2026-10-28: Tailscale ships fixes for SSH vulnerabilities (https://helpnetsecurity.com/2026/10/28/tailscale-fixes-tailworm-ssh-flaws)
- 2026-10-28: Tailscale releases version 1.104.4 fixing the SSH flaws (https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html)
- 2026-10-27: The vendor is working on patches for nearly a dozen security vulnerabilities involving Tailscale SSH. (https://bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation)
- 2026-10-25: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers (https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html)

## Sources

- 2026-10-25 The Hacker News: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
- 2026-10-27 BleepingComputer: Tailscale warns of SSH flaws allowing root privilege escalation https://bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation
- 2026-10-27 SecurityWeek: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws https://securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws
- 2026-10-28 The Hacker News: Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html
- 2026-10-28 Help Net Security: Tailscale fixes SSH flaws allowing lateral movement within tailnets https://helpnetsecurity.com/2026/10/28/tailscale-fixes-tailworm-ssh-flaws

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.