Security Researcher Discloses Unpatched Tailscale SSH Flaws Allowing Root Access on Other Servers

A security researcher has published findings on 'Tailworm' vulnerabilities in Tailscale SSH, indicating that a single compromised device on a Tailscale network could be used to gain root access to other servers if Tailscale SSH is configured for port forwarding. The findings, published in a report, detail tests on Tailscale version 1.104.2 and headscale version 0.29.5. Tailscale has acknowledged the report and is investigating the issues to develop fixes.