Security1 hOctober 28, 2026, 07:40

Cyberdione finds 11 unfixed flaws in Tailscale and headscale

Cyberdione Labs published an audit of 11 vulnerabilities in Tailscale 1.104.2 and headscale v0.29.5, grouped as Tailworm. The most serious is in the SSH forwarding path, where races and a missing privilege drop allow root code execution on the target node. Tailscale acknowledged the reports and targets patches by October 27.

DEV Community

Open source

Cyberdione finds 11 unfixed flaws in Tailscale and headscale

11 flaws in Tailscale 1.104.2 and headscale v0.29.5
SSH forwarding path yields root code execution and key capture
headscale: unauthenticated memory exhaustion blocks onboarding
Vendor advises TS_SSH_DISABLE_FORWARDING=1 until patched

#Tailscale#Headscale

Tailscale warns of 11 flaws, including root privilege escalation via SSH

Security

Proton Mail left sender-spoofing flaw unfixed for 16 months

Security

Unpatched Tailscale SSH Flaws Let a Hacked Device Reach Root on Other Servers

Software

Cyberdione finds 11 unfixed flaws in Tailscale and headscale

Tailscale warns of 11 flaws, including root privilege escalation via SSH

Proton Mail left sender-spoofing flaw unfixed for 16 months

Unpatched Tailscale SSH Flaws Let a Hacked Device Reach Root on Other Servers

18 of 26 Node.js starters ship unfixable high-severity flaws