Tailscale confirms privilege escalation flaws in SSH, patched client due October 27
cocktailpeanut · x · 2026-10-27
Tailscale published an investigation update (Oct 26) on Tailscale SSH vulnerabilities reported as "Tailworm": most identified issues involve privilege escalation, where an already-authorized SSH user may exceed their configured local user's permissions. Exploitability depends on grants and configuration; Tailscale does not recommend disabling Tailscale SSH broadly. Fixes for most issues are done, with a patched client targeted for October 27. Interim advice: review and tighten SSH access policies. Developer cocktailpeanut notes the issue only affects Tailscale SSH, not regular tunnels.
Related event: Tailscale Confirms Critical Tailworm SSH Flaws, Patches Released(2 posts)→
More from Safety
- Mantic forecasts open-weight models 9 months behind frontier in offensive cyber capability — tshevl · 2026-10-28
- Fangcun AI publishes third-party safety evaluation of DeepSeek V4.1 Flash-1017 for manipulation risks — pstAsiatech · 2026-10-28
- Study finds no real-world multilingual benchmarks for clinical AI scribes in India — DrDatta_AIIMS · 2026-10-28
- Grim Test finds AI shows no mercy for humans even while causing suffering — hollee-o · 2026-10-28
- Critic slams NYT for platforming 'TESCREAL' AI-safety circles — mjdramstead · 2026-10-28
- METR researcher joining Anthropic sparks concerns over eval lab independence — ShakeelHashim · 2026-10-28