The vulnerabilities detailed: how a compromised device can dominate a network

The Tailworm report describes vulnerabilities enabling an attacker controlling a device already authorized in a Tailscale network to escalate privileges to gain root access on other servers. These flaws exploit mechanisms such as port forwarding, app connectors, and bugs specific to Headscale, an open-source alternative to Tailscale. According to Erica Windisch, a researcher at Cyberdione Labs, the attack requires no passwords or stolen keys, only an initial foothold on a compromised device (via phishing, malware, or vulnerable web applications).

Among the documented vulnerabilities: a race condition in Tailscale SSH allowing commands to be executed as root via a standard SSH session, a flaw in Headscale blocking the control server through memory exhaustion, and an experimental feature (conn25) enabling traffic to be sent to any destination, including cloud services containing sensitive credentials. The report also highlights that Headscale 0.29.5 does not allow disabling port forwarding, worsening server exposure.

Tailscale does not create the initial breach, but it can turn a minor flaw into privileged access across an entire IT infrastructure, and at machine speed.

Lab demonstrations: lightning-fast propagation, but with conditions

Tests conducted between October 22 and 24, 2026, by Erica Windisch showed that the exploitation chain could spread in less than one second per hop between devices, provided that per-pair access rules were not strictly configured. The report cites a demonstration where an attacker could read the /etc/shadow file (containing encrypted user passwords) in seconds via an SSH session with forwarding permissions. However, this automatic propagation depends on hardware keys (TPM/Secure Enclave) and network configurations, leading to debates among researchers about the qualification of wormable.

A critical vulnerability also allows adding a malicious device to the network by capturing an enrollment key, thus expanding the attack surface. The report notes that default access rules prevented propagation in the tests but emphasizes that their absence or laxity could facilitate massive escalation.

Tailscale’s response: patches in progress, but no official disclosure yet

Tailscale has not yet published a security advisory, a CVE number, or a patch, despite the report's release. Mike Shaver, vice president of engineering at Tailscale, confirmed on Reddit that the company was working on fixes after receiving the report, without individually validating each vulnerability. He recommended that users review their SSH access policies, restrict port forwarding permissions, and enable SSH check mode to mitigate risks.

Unlike its past practices (such as patches TS-2026-006, TS-2026-009, and TS-2026-010), Tailscale did not adopt a coordinated disclosure approach. Erica Windisch stated she contacted the company before publication but made her report public without waiting for a formal response. This method has drawn criticism, particularly regarding the lack of transparency about the urgency of fixes.

What this changes here: risks for businesses and administrations in West Africa

For Beninese or West African businesses and administrations using Tailscale SSH or Headscale to secure their internal networks or remote connections, these vulnerabilities could turn an initial breach into a large-scale compromise if access rules are not strictly segmented. For example, an employee whose device is infected via a phishing email could, without intervention, grant access to critical servers hosting sensitive data or payment systems.

Organizations relying on Headscale for open-source deployments are particularly exposed, as version 0.29.5 does not allow disabling port forwarding, a direct gateway to root privileges. Administrations using similar solutions to interconnect remote sites should audit SSH permissions immediately and disable non-essential features like app connectors, unless their use is strictly controlled.

Finally, the regional context of growing cyber threats (such as the compromise of over 300 Tor relays in October 2026 to steal credentials, according to The Hacker News) underscores the urgency of these fixes. An attack exploiting these vulnerabilities could target less protected infrastructures, hence the need to limit access to sensitive resources and monitor devices connected to the network.

Immediate recommendations for Tailscale and Headscale users

Erica Windisch recommends in her report to disable Tailscale SSH and app connectors if an audit of forwarding permissions cannot be conducted immediately. Tailscale advises users to:

• Review and restrict SSH access rules, applying the principle of least privilege.
• Disable port forwarding for non-critical devices.
• Enable SSH check mode to limit risks related to connections.
• Automatically update Tailscale and Headscale versions as soon as fixes become available.
• Monitor connected devices on the network to detect any suspicious activity.

For organizations using older versions or custom configurations, a risk assessment by a security expert is essential before any update. The Tailworm report highlights the importance of segmenting networks and limiting default permissions, a practice already recommended but often neglected in professional environments.