Tailworm – Tailscale Vulnerabilities

Researchers have identified multiple critical vulnerabilities in Tailscale and headscale software that undermine their security promises, including privilege escalation risks, missing authentication layers, and broader-than-advertised network boundaries. The vulnerabilities were discovered in Tailscale v1.104.2 and headscale v0.29.5 across components including the SSH server, DERP relay client, and control server, with attackers potentially gaining root execution on target servers. The researchers emphasize that rapid disclosure is necessary to expedite remediation, as the vulnerabilities were discovered through low-effort attacks against unmodified, released software.