Security1 hOctober 27, 2026, 21:09

Tailscale warns of 11 flaws, including root privilege escalation via SSH

Cyberdione Labs found 11 vulnerabilities (Tailworm) in Tailscale 1.104.2 and headscale v0.29.5, including a critical SSH server flaw enabling root code execution via Unix-socket forwarding. Tailscale confirmed the issues are serious and aims to ship patches by October 27, advising tighter SSH policies and disabling forwarding.

BleepingComputer

Open source

Tailscale warns of 11 flaws, including root privilege escalation via SSH

11 Tailworm flaws found in Tailscale 1.104.2 and headscale v0.29.5
Critical SSH server bug allows code execution with root privileges
Patches targeted for October 27; disabling Tailscale SSH not advised
Mitigation: TS_SSH_DISABLE_FORWARDING=1 and tighter access policies

#Tailscale#Headscale

Unpatched Tailscale SSH Flaws Let a Hacked Device Reach Root on Other Servers

Security

Ivanti Connect Secure: exploited privilege escalation to root

Security

Nix and Lix fix local root privilege-escalation flaws

Security

Tailscale warns of 11 flaws, including root privilege escalation via SSH

Unpatched Tailscale SSH Flaws Let a Hacked Device Reach Root on Other Servers

Ivanti Connect Secure: exploited privilege escalation to root

Nix and Lix fix local root privilege-escalation flaws

LiteLLM CVE-2026-114612 allows privilege escalation to proxy admin