Tailscale confirms serious Tailworm SSH flaws; fix due within 24 hours
AIFlow_ML · x · 2026-10-27
Tailscale confirmed the 'Tailworm' SSH vulnerabilities reported by researcher Erica Windisch (Cyberdione Labs) are real and 'serious': on networks where Tailscale SSH allows port forwarding, a single compromised device can gain root access to other reachable servers. Testing covered Tailscale 1.104.2 and headscale 0.29.5; at publication there was no CVE, bulletin, or patched version, with a fix targeted within 24 hours.
- VP of engineering Mike Shaver said Tailscale is not recommending everyone disable Tailscale SSH.
- Many robot fleets and AI labs run on Tailscale, raising practical concern.
- Interim mitigation: set TSSSHDISABLEFORWARDING=1 in the tailscaled service and restart, plus tighten SSH access rules to only required users/devices.
More from Infra
- Gradium's open-weight TTS runs offline on iOS/macOS, benchmarked vs Kokoro and PocketTTS — amos_gyamfi · 2026-10-27
- Open-source auto-research agent hits Top 2 on GPU kernel challenge in 7 hours — sguada · 2026-10-27
- 7 robot OEMs post simulation-ready assets on Hugging Face amid NVIDIA deal — lukas_m_ziegler · 2026-10-27
- PKU paper redesigns video storage: decoupled frames cut random-access decode cost — PKU · 2026-10-27
- CA eMudhra blocks curl/wget User-Agents from CRL endpoints, Mozilla bug filed — kingslyj · 2026-10-27
- Running AI agents on a legacy IBM WMS: enforce tool order, script checks, verify evidence — ksrijith · 2026-10-27