DEV Community

Anoymask
Anoymask

Posted on

Tailworm: Multiple Vulnerabilities in Tailscale SSH Forwarding Leading to Root Privilege Escalation

#security #threatintel

1. Basic Information

2. Executive Summary

Researchers reported 11 findings from laboratory testing of Tailscale 1.104.2 and headscale 0.29.5, including issues in Tailscale SSH. Because Unix socket forwarding operations execute bind, dial, and unlink actions with root privileges, an authorized low-privileged SSH user can exploit race conditions or path replacement to escalate privileges, leading to arbitrary code execution as root, theft of tailnet enrollment keys, or unauthorized deletion of root-owned files. Note that these findings include security recommendations and expected behaviors, and not all 11 items represent independent, distinct vulnerabilities. No active exploitation by third-party attackers has been confirmed, and establishing an SSH forwarding path requires SSH connection access to the target node as well as forwarding permissions. The SSH connection conditions should not be generalized to other findings such as unauthenticated DoS in headscale.

This is a significant design and implementation issue allowing authorized users with low-privileged SSH access to escalate to root, directly impacting infrastructure environments that use Tailscale SSH as a management path for internal nodes. Public disclosures are based on reproduction experiments in the researchers' own environment and do not constitute evidence of incidents caused by malicious third parties.

3. Attack Flow

SSH and conn25 are separate paths and do not represent sequential attack stages. The following outlines the researchers' testing conditions rather than third-party incident cases.

Privilege Escalation from Tailscale SSH Forwarding

  1. An attacker connects as a low-privileged user from an approved device using SSH policy rules. The Unix socket forwarding issue also requires policies to permit local or remote forwarding.
  2. The attacker induces path races or replacements through Unix socket forwarding, causing tailscaled, running as root, to perform bind, dial, and unlink operations.
  3. Privileged socket connections and file operations are used to advance to root code execution, key theft, and file deletion.

Bypassing Destination Control via conn25

  1. Using the experimental conn25 feature, a device with connector capability registers an attacker-specified actual destination. Tailscale describes conn25 as an unreleased pre-production feature, and stable App Connectors are not affected.
  2. Because ACLs are not applied to the translated destination, connections can reach cloud metadata services or internal LAN services outside the tailnet. Do not generalize this result to reachability for other tailnet nodes.
  3. Acquired credentials and internal reachability may be leveraged for subsequent compromises.

The following table summarizes the attack flows and investigation considerations based on researchers' verification results and public disclosures. It does not indicate that the entire attack chain is established or successful across all Tailscale operational environments. The first three rows represent the SSH path, and the last row represents the independent conn25 path.

Inference: The defender indicators are investigation leads to check against available endpoint, authentication, and network records. They do not specify a fixed audit log format or a process parent-child relationship that must always occur.

Attack Stage Attacker Actions and Techniques Tools and Communications Defender Indicators (Prerequisites and Artifacts)
Authorized SSH Connection Establishment Connects to the target node as a standard user from an approved device based on Tailscale SSH policies. Tailscale client, tailscale ssh Correlate obtainable SSH connection and authentication logs with SSH policies corresponding to the user, device, and target node
Socket Forwarding Request and Path Conflict Sends local or remote forwarding requests, inducing symbolic link replacement or race conditions on Unix socket paths. SSH socket forwarding, race condition scripts Forwarding must be permitted by policy; repeated suspicious creation or deletion of sockets in /tmp or specific paths
Privileged Operations and Privilege Escalation Forces tailscaled, running with root privileges, to bind/dial privileged paths, achieving root code execution or key theft. Privileged socket communications such as Docker socket and tailscaled local APIs demonstrated by researchers, file replacement Startup of root-privileged processes associated with the target SSH session (not necessarily direct children of tailscaled), modification of root-owned files, access to enrollment key files
conn25 Destination Control Bypass (Experimental Feature) Uses the unreleased conn25 feature, where a device with connector capability registers actual destination translation with a connector, attempting to connect to destinations outside the tailnet. conn25 experimental flag, custom connector settings Requires enabling the experimental feature conn25 (stable App Connectors are unaffected). Connections to IP destinations outside the tailnet or to cloud IMDS

4. Attacker Position and Execution Location

  • For the Tailscale SSH path, an approved device or identity permitted to connect to the target node is required.
  • For headscale DoS, unauthenticated peers with network reachability to the control server are assumed.

5. Perspective from Victims and Administrators

  • Victims: General users may observe service disruptions or connection failures.
  • Administrators: Depending on the finding, indicators may include unauthorized operations on root-owned files, Unix socket connections, or increased memory use by tailscaled. The SSH findings and the separate conn25 and headscale paths have different prerequisites.

6. Success and Failure Conditions

Success Conditions

  • The target must be using vulnerable versions and features.
  • The Unix socket forwarding issue in SSH requires an approved device or identity permitted by policy to execute SSH connections and local/remote forwarding to the target.
  • The relevant vulnerable forwarding, Serve, or conn25 code path must be enabled; the required feature and access conditions differ by finding.

Failure Conditions and Mitigations

  • As a temporary mitigation, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart. This mitigates the SSH forwarding path and does not patch all findings such as Serve or headscale.
  • Restrict SSH access policies per user-device pair.
  • Update to Tailscale 1.104.4 or later. SSH and Serve issues in official bulletins TS-2026-014 through 017 have been resolved. Do not assume issues in headscale 0.29.5 are resolved solely by updating the Tailscale client; verify separate remediation statuses.

7. What Happens Upon Success

  • Arbitrary code execution as root, enrollment key theft, and deletion of root-owned files.
  • Reachability to cloud metadata and internal networks.
  • Memory exhaustion of headscale or client agents.

8. Observable Logs

Inference: The following are investigation candidates based on behaviors and identifiers in public documentation. These do not verify that each log records or provides obtainable fields on real systems. Results depend on configuration and log retention settings, and a single match does not confirm successful compromise.

  • Email: No unique email-based indicators were identified in public documentation.
  • Proxy / SWG / DNS: None specified.
  • Endpoint / EDR: Verify unexpected processes under tailscaled, root-privileged file modifications, and Unix socket connections.
  • Identity / IdP: Check Tailscale SSH audit logs for users, devices, targets, and policy rules.
  • SaaS / Cloud: Verify access to metadata services followed by cloud API operations.
  • Network: Check connections to internal destinations and cloud metadata services. Correlate SSH-related activity with the relevant SSH session; investigate the separate conn25 path independently rather than requiring a preceding SSH session.

9. Determining Attack Success

  • Attack Attempt Observed (Success Unconfirmed): Tailscale SSH connections or forwarding requests alone do not indicate root privilege acquisition. (Evaluated based on internal criteria.)
  • Privilege Escalation Confirmed: Criteria: Identify unauthorized root-owned file operations or privileged socket connections corresponding to low-privileged sessions. This alone does not confirm arbitrary root code execution; separate evidence of root-privileged process execution must be verified. (Reproduced by researchers in a lab; not evidence of third-party victimization.)

10. Investigation Playbook

  1. Trigger: Unauthorized root-owned file operations associated with Tailscale SSH, or suspicious metadata access through the separate conn25 path
  2. Initial Verification: Check client/headscale versions, SSH policies, and forwarding environment variables
  3. Endpoint Investigation: Preserve tailscaled process trees, sockets, and file operations
  4. Authentication and Cloud: Verify metadata access and credential usage
  5. Subsequent Actions: Trace lateral movement using acquired credentials
  6. Containment: Stop forwarding, restrict policies, isolate nodes, and update
  7. Classification Boundaries: Distinguish between connections, forwarding, privilege escalation, credential access, and subsequent compromise

11. Defense and Detection Ideas

  • Single Event: Unexpected unlink/bind of privileged paths by tailscaled
  • Timeline Correlation: For the SSH path, correlate the SSH session → socket forwarding → privileged operation or root process. Separately correlate conn25 mappings and outbound connections to metadata or internal services.
  • Hunting: Inventory Tailscale node versions and enabled forwarding states
  • Log Gaps: Establishing success is difficult without payload or socket audits
  • Priority Actions: Prioritize stopping forwarding and applying patches

12. Facts, Inference, and Hypothesis

Facts

  • Researchers evaluated unmodified Tailscale 1.104.2 and headscale 0.29.5, reporting 11 findings, which include configuration cautions and behavioral specifications.
  • File operations during Unix socket forwarding execute as root, demonstrating a path from authorized sessions to root code execution, enrollment key theft, and root file deletion.
  • Tailscale resolved SSH and Serve issues in version 1.104.4. The GitHub release was published on October 28, 2026, at 01:05:26 UTC. Prerequisites and fix details can be verified in TS-2026-014 through 017.
  • The experimental conn25 feature reported issues allowing reachability to cloud metadata, internal LANs, and Kubernetes services outside the tailnet. According to Tailscale, this is an unreleased pre-production feature, and stable App Connectors are unaffected.
  • No reports of active third-party exploitation were found in the reviewed documentation.

Inference

  • Organizations permitting Tailscale SSH for jump hosts or management servers must treat forwarding feature availability, not just standard OS account permissions, as a security boundary.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unresolved Items and Further Investigation."

13. MITRE ATT&CK Mapping

There are no actionable mappings with verifiable supporting evidence.

14. Unresolved Items and Further Investigation

  • Regarding headscale 0.29.5, the product's fixed versions and deployment status require separate verification independent of the Tailscale 1.104.4 patch scope.
  • Whether exploitation has occurred in real-world deployments.
  • Exact initial publication date of the primary source. The source does not establish that the final day of testing was also the publication date.

15. Impact on SOCs and Organizations

Organizations operating Tailscale for maintenance access, development environments, or cloud management servers should inventory their SSH policies and forwarding configurations, and update to version 1.104.4 or later. Until updates are applied, disable unnecessary forwarding and evaluate Serve, experimental features, and headscale separately.

16. Summary by Target Audience

  • For SOCs: Correlate Tailscale SSH sessions with Unix socket operations and root-privileged processes. Investigate metadata access through conn25 separately; it does not require a preceding SSH session.
  • For Administrators: Update to Tailscale 1.104.4 or later. As a temporary mitigation for SSH forwarding prior to updating, set TS_SSH_DISABLE_FORWARDING=1 in the service environment and restart tailscaled. Verify separate remediation statuses for headscale.
  • For Users: Limit Tailscale SSH usage permissions to the minimum necessary and follow administrators' update instructions.

Top comments (0)