FULL STORY
Tailworm: The Tailscale Vulnerability Saga
A researcher bypassed coordinated disclosure to publish 11 unpatched Tailscale flaws; after initial pushback, Tailscale confirmed the critical 'Tailworm' SSH flaw and shipped a patch.
2026-10-25 ~ 2026-10-27 · 3 episodes · 8 posts
Episode 1 · Researcher Bypasses Disclosure Process, Publishes 11 Unpatched Tailscale Flaws (2026-10-25, 3 posts)
Researcher Erica Windisch of Cyberdione Labs skipped coordinated vulnerability disclosure and publicly revealed 11 unpatched Tailscale flaws, including an SSH race condition that could yield root access, sparking debate in the security community.
- Researcher publishes 11 unpatched Tailscale flaws, skipping coordinated disclosure — basedjensen · 2026-10-25
- Researcher publishes 11 unpatched Tailscale flaws before vendor disclosure, drawing security community backlash — dkundel · 2026-10-25
- Researchers publish 11 unpatched Tailscale flaws; SSH race condition yields root on servers — AIFlow_ML · 2026-10-26
Episode 2 · Tailscale Says SSH Vulnerability Concerns Don't Affect Most Users (2026-10-26, 3 posts)
Tailscale's engineering VP said the company is investigating reported SSH vulnerabilities with outside experts and urged no blanket ban, while developers clarified that Tailscale SSH is disabled by default and shared steps for users to check whether they actually use it.
- Tailscale VP of Engineering responds to SSH vuln concerns: no need to disable it yet — basedjensen · 2026-10-26
- Quick 3-step check reveals most Tailscale users never enabled the vulnerable SSH feature — cocktailpeanut · 2026-10-27
- Tailscale SSH Is Disabled by Default — Most Casual Users Unaffected by Advisory — cocktailpeanut · 2026-10-27
Episode 3 · Tailscale Confirms Critical Tailworm SSH Flaws, Patches Released (2026-10-27, 2 posts)
Tailscale confirmed the critical "Tailworm" SSH privilege-escalation vulnerabilities reported by researcher Erica Windich and shipped fixes within about 24 hours, requiring no full service shutdown.
- Tailscale confirms serious Tailworm SSH flaws; fix due within 24 hours — AIFlow_ML · 2026-10-27
- Tailscale confirms privilege escalation flaws in SSH, patched client due October 27 — cocktailpeanut · 2026-10-27