Tailscale has released fixes for vulnerabilities in its built-in SSH server that could allow an attacker who already has access to a device in a tailnet to reach services and files on other machines with root-only privileges. The company says the issues involve Tailscale SSH’s port- and socket-forwarding logic, which runs inside the tailscaled background daemon that operates with root privileges.
According to multiple outlets, the flaws affect how Tailscale SSH validates paths and performs forwarding actions (including local and remote forwarding). The overall risk is framed as potential lateral movement across devices within the same tailnet, constrained by tailnet policy rules that already permit SSH connections.
Coverage also reflects two related reporting threads. Dev.to describes a researcher’s “Tailworm” report detailing multiple security problems and emphasizes that several SSH issues stem from root execution combined with incorrect permission/path handling. Other outlets focus more directly on the specific patched release (v1.104.4) and the lateral movement or root-privilege escalation consequences described by the Tailscale team.
