Tailworm: what to do about Tailscale SSH before the fix ships

A reported vulnerability dubbed Tailworm affects Tailscale SSH versions with Unix socket forwarding, potentially allowing an attacker controlling a device authorized by an SSH rule to access root-privileged sockets on reachable Linux hosts or Macs running the open-source tailscaled daemon. The issue arises because tailscaled performs certain forwarding operations as root after authenticating a user, while path validation may not enforce the logged-in user’s permissions; the report also identifies concerns involving app connectors, tailscale serve configurations, and resource exhaustion in related components. Tailscale acknowledged the report and indicated it was investigating and developing fixes, while some claims and the “wormable” characterization remain disputed and no public advisory, CVE, or fixed release had been issued at the time described. Organizations can assess exposure by identifying hosts with Tailscale SSH enabled and forwarding available, then disable forwarding using the TS_SSH_DISABLE_FORWARDING environment variable or disable Tailscale SSH entirely where unnecessary. The account also recommends continuously enforcing these settings, narrowing SSH authorization rules, enabling key expiry and Tailnet Lock where feasible, reviewing Unix-socket service exposures, and revoking compromised devices through the administrative console.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.