Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Summary: Tailscale released version 1.104.4 to fix flaws in its built-in SSH server's socket forwarding, where the tailscaled process checked a Unix socket path and then operated as root, allowing a timing trick to swap in a different path after the check. Erica Windisch of Cyberdione Labs, who published the Tailworm report, produced a root shell and read /etc/shadow by forwarding to the Docker control socket in her lab tests, and said one compromised device could spread to every device the policy allowed in under a second per step.
Key Takeaway: Tailscale SSH authorizes by device identity and policy file rather than passwords or keys, so an attacker needs only a foothold on a device the policy already trusts - and on self-hosted headscale, forwarding is granted on every accepted session and cannot be turned off, so Windisch's report says every SSH grant there should be treated as giving root.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026