Ethical Hacking News
A critical vulnerability has been identified in the Tailscale SSH protocol, allowing a single compromised device to gain root access to other servers on a network. The vulnerability, discovered by Erica Windisch of Cyberdione Labs, highlights the importance of proper configuration and monitoring of network security protocols. Users are advised to take certain precautions to mitigate the risk, including reviewing their Tailscale SSH access rules and turning off SSH port forwarding where possible. By taking these steps, users can help to minimize the risk of this vulnerability being exploited and ensure the security of their networks.
A recent vulnerability in the Tailscale SSH protocol has been identified, leaving networks exposed to potential attacks. The vulnerability allows a single compromised device on a Tailscale network to gain root access to other servers it can reach. The vulnerability can be exploited by an attacker with control of a device on the network that the Tailscale SSH server has access to. The vulnerability is considered "wormable" and could allow a compromised device to spread to other devices on the network. The Tailscale company is working to fix the vulnerability, but advises users to take precautions to mitigate the risk. Users are advised to review their Tailscale SSH access rules, turn off SSH port forwarding, and take other security measures to minimize the risk of exploitation.
A recent vulnerability in the Tailscale SSH protocol has been identified, leaving networks exposed to potential attacks. The vulnerability, discovered by security researcher Erica Windisch of Cyberdione Labs, allows a single compromised device on a Tailscale network to gain root access to other servers that it can reach.
The Tailscale SSH protocol is a self-hosted server that some networks use to run Tailscale instead of the company's hosted service. The protocol allows users to securely access and manage remote servers, but it also provides a significant security risk if not properly configured. The vulnerability, which was identified in Tailscale version 1.104.2 and headscale version 0.29.5, allows an attacker to gain root access to a target server by exploiting a vulnerability in the protocol's port forwarding mechanism.
To exploit this vulnerability, an attacker would need to have control of a device on the network that the Tailscale SSH server has access to, and the server would need to be configured to allow port forwarding. The attacker would then be able to use the compromised device to establish a SSH connection to the target server, and then gain root access to the server.
The vulnerability is considered to be "wormable," meaning that it could allow a compromised device to spread to other devices on the network without the need for human intervention. In the lab, Windisch demonstrated the vulnerability by showing how a single compromised device could spread to every device on the network in under a second.
The Tailscale company has responded to the vulnerability by stating that they are working to fix it, but that they are still in the process of determining which configurations are affected. In the meantime, the company is advising users to take certain precautions to mitigate the risk, such as reviewing their Tailscale SSH access rules and turning off SSH port forwarding where possible.
The vulnerability is a significant concern, as it highlights the importance of proper configuration and monitoring of network security protocols. It also serves as a reminder that even seemingly secure protocols can have critical vulnerabilities if not properly implemented.
In order to minimize the risk of this vulnerability being exploited, users are advised to take the following steps:
* Review your Tailscale SSH access rules and ensure that they are configured to prevent port forwarding to unauthorized devices.
* Turn off SSH port forwarding where possible.
* Remove app connector permissions from devices that do not need them.
* Remove any Tailscale serve forward that points at a Unix socket.
* Turn on node-key expiry, so a stolen device key does not stay valid forever.
* If a device is compromised, delete it at the control plane. Reimaging the machine does not revoke keys an attacker may have already copied off it.
By taking these precautions, users can help to minimize the risk of this vulnerability being exploited and ensure the security of their networks.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Tailscale-SSH-Flaw-Exposed-A-Critical-Vulnerability-Putting-Entire-Networks-at-Risk-ehn.shtml
https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
Published: Mon Oct 26 13:25:34 2026 by llama3.2 3B Q4_K_M
