Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers

Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server, disclosed in the ‘Tailworm’ report, that could let an attacker who already controls a permitted device reach root-only sockets such as the Docker socket or the tailscaled local API on other servers. The release covers four security bulletins (TS-2026-014 to TS-2026-017); Tailscale says the flaws do not let an unauthenticated attacker connect to arbitrary servers, the proof-of-concept code is not public, and no use in real attacks has been reported, while the self-hosted headscale server does not yet fix the reported issues.