Tailscale Client (<= 1.104.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tailscale-client--1.104.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 16:06:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTailscale SSH Privilege Escalation Vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/Tue, 27 Oct 2026 16:06:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tailscale-tailworm/Multiple privilege escalation and access control bypass vulnerabilities in Tailscale SSH, collectively dubbed Tailworm, allow an authenticated attacker to perform lateral movement and local privilege escalation.Tailscale is addressing a series of 11 vulnerabilities collectively dubbed 'Tailworm' affecting the Tailscale client (version 1.104.2 and earlier) and the headscale control server (version 0.29.5 and earlier). The most severe findings involve the Tailscale SSH feature, where improper handling of Unix privileges and SSH forwarding can allow an attacker who has gained a foothold on one device to bypass access policies and escalate to root privileges on target servers within the mesh network. There is currently no evidence of in-the-wild exploitation.

Impact

Successful exploitation allows an attacker to move laterally across the mesh network and achieve root execution on target servers. The vulnerabilities can also lead to the exposure of administrative interfaces, access to cloud metadata services, and potential denial-of-service conditions.

Recommendation

  • Disable Tailscale SSH forwarding in existing access policies where not explicitly required as an immediate mitigating measure.
  • Review all current Tailscale SSH access policies to limit the potential reach of compromised nodes.
  • Patch Tailscale client and headscale control server installations as soon as the vendor releases the finalized versions.
  • Monitor for unauthorized device registration or abnormal lateral movement patterns originating from within the mesh VPN environment.
]]>highthreat