Tailworm Report Finds Root Escalation Flaw in Tailscale SSH

Security researcher Erika Windisch of Cyberdione Labs published the Tailworm report, disclosing 11 vulnerabilities across the Tailscale client (version 1.104.2) and the open-source control server Headscale (version 0.29.5).

The most severe finding affects Tailscale's built-in SSH server. Because the background tailscaled daemon runs with root privileges, improper handling of Unix socket forwarding can allow an attacker to trick the daemon into reading protected system files, such as /etc/shadow, that should be off-limits to normal SSH users.

The flaw is not an unauthenticated remote exploit over the open internet. To abuse the mechanism for lateral movement, an attacker must already control an authorized, trusted machine inside the tailnet. The report also highlights methods for circumventing network boundaries via the experimental conn25 component and the tailscale serve utility.

Until patched releases arrive, the research recommends mitigating the vector by setting the environment variable TS_SSH_DISABLE_FORWARDING=1, tightening access control lists to specific node pairs, and immediately revoking keys in the admin console whenever a node is suspected of compromise, as reinstalling the operating system does not invalidate leaked mesh credentials.

Source: habr