{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/headscale--0.29.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tailscale client (\u003c= 1.104.2)","headscale (\u003c= 0.29.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Tailscale"],"content_html":"\u003cp\u003eTailscale is addressing a series of 11 vulnerabilities collectively dubbed 'Tailworm' affecting the Tailscale client (version 1.104.2 and earlier) and the headscale control server (version 0.29.5 and earlier). The most severe findings involve the Tailscale SSH feature, where improper handling of Unix privileges and SSH forwarding can allow an attacker who has gained a foothold on one device to bypass access policies and escalate to root privileges on target servers within the mesh network. There is currently no evidence of in-the-wild exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to move laterally across the mesh network and achieve root execution on target servers. The vulnerabilities can also lead to the exposure of administrative interfaces, access to cloud metadata services, and potential denial-of-service conditions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDisable Tailscale SSH forwarding in existing access policies where not explicitly required as an immediate mitigating measure.\u003c/li\u003e\n\u003cli\u003eReview all current Tailscale SSH access policies to limit the potential reach of compromised nodes.\u003c/li\u003e\n\u003cli\u003ePatch Tailscale client and headscale control server installations as soon as the vendor releases the finalized versions.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized device registration or abnormal lateral movement patterns originating from within the mesh VPN environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T16:40:11Z","date_published":"2026-10-27T16:06:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/","summary":"Multiple privilege escalation and access control bypass vulnerabilities in Tailscale SSH, collectively dubbed Tailworm, allow an authenticated attacker to perform lateral movement and local privilege escalation.","title":"Tailscale SSH Privilege Escalation Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/"}],"language":"en","title":"CraftedSignal Threat Feed - Headscale (\u003c= 0.29.5)","version":"https://jsonfeed.org/version/1.1"}