Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A single compromised device on a Tailscale network can be used to gain root access to other servers it can reach through Tailscale SSH, according to a report published October 25 by researcher Erica Windisch of Cyberdione Labs. The findings, tested against Tailscale version 1.104.2 and headscale version 0.29.5, had no CVE identifier, security bulletin or fixed version as of publication; Tailscale said it had received the report, was already examining the same areas with outside specialists, and was not recommending that everyone disable Tailscale SSH.