Tailscale 1.104.4 fixes SSH forwarding privilege flaws

Tailscale has released version 1.104.4 to address four security issues in Tailscale SSH, including socket-forwarding flaws that could allow an attacker controlling an already permitted device to reach services and files normally restricted to root. The company identified the most serious issue in bulletin TS-2026-014.

The findings were published as Tailworm by Erica Windisch of Cyberdione Labs after testing released Tailscale clients and the self-hosted headscale control server in a lab. Tailscale said the flaws do not let an unauthenticated attacker connect to arbitrary Tailscale SSH servers: the attacker must first control a device that network policy permits to open an SSH session to the target, with forwarding enabled.

How SSH forwarding created the risk

Tailscale SSH authorizes connections through device identity and the network policy file rather than a password or SSH key. That means a compromised device already trusted by policy can be sufficient to begin an approved session, without stolen user credentials.

The vulnerable forwarding path checked a Unix-socket path, then performed the operation through the root-privileged Tailscale background process. Windisch described a timing technique that could replace the path after the check, bypassing the intended restriction on sockets reachable through forwarding.

In her tests, forwarding to the Docker control socket produced a root shell and allowed access to /etc/shadow. Tailscale describes the impact more narrowly as access to root-only sockets, including the Docker socket and the tailscaled local API. The container-to-host privilege boundary is also relevant because container flaws leading to host root access illustrates how a container flaw can lead to root access on its host.

Four bulletins and the changes in 1.104.4

In version 1.104.4, Tailscale changed SSH forwarding to run as the logged-in user rather than root. It also replaced its earlier path check with the operating system’s file-permission controls.

• TS-2026-014: SSH socket forwarding could reach root-only sockets from a permitted session.
• TS-2026-015: A permitted session could consume server memory and crash the Tailscale process, interrupting all Tailscale networking on that node.
• TS-2026-016: A tailscale serve forward to a Unix socket could reach the tailscaled local API, with a related socket-swap issue.
• TS-2026-017: TLS serve configurations with two or more mounts could return another mount’s permission headers in one request.

Tailscale SSH server support applies to Linux and the open-source macOS build, although an attacking device can run any platform. The bulletins had no CVE identifiers, severity scores or oldest affected versions at publication. Neither Tailscale nor Windisch reported real-world exploitation, and the proof-of-concept code has not been made public.

Steps for administrators

Organizations using Tailscale SSH should update to 1.104.4 or later. Where an immediate server update is not possible, Tailscale recommends setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. This disables forwarding without disabling Tailscale SSH and blocks several of the more serious issues.

Administrators should also review SSH access policies so that only necessary users and devices can connect. SSH check mode can require a new sign-in before a session begins, but it does not stop forwarding abuse inside an approved session. For a potentially compromised device, reimaging alone does not revoke its device key; it remains valid until the device is deleted in the control plane.

Headscale users face a separate operational concern: Windisch reported that SSH forwarding is granted on every accepted session and cannot be disabled in policy, while headscale 0.29.5 does not fix the reported issues. The practical business implication is to patch Tailscale SSH systems promptly, restrict trusted device paths, and treat existing device identities as credentials that require active revocation when compromise is suspected.