Erica Windisch of Cyberdione Labs published 11 findings on 25 October against Tailscale 1.104.2 and headscale 0.29.5, from lab testing run between 22 and 24 October on unmodified releases. The set is being called Tailworm.

There is no CVE, no vendor bulletin and no fixed version. That is unusual enough to be half the story.

What the report says

Of the 11, the finding that carries the rest is in Tailscale SSH: its Unix-socket forwarding runs as root. A device holding an approved SSH rule can reach root on the target, and in the lab that was enough to read /etc/shadow. A second finding is a rename race defeating the path allowlist, which reaches sockets such as the Docker socket, again as root.

Reaching the Docker socket as root on a host is, for practical purposes, the host.

The remaining findings are smaller and more varied: access-control bypasses in the experimental app connector feature, a serve forward that reaches the local API, and memory exhaustion in headscale and in DERP.

The threat model, stated plainly

Tailworm is lateral movement from an existing foothold, and 2 things have to be true before any of it applies: the attacker already controls a device on your tailnet, and your access rules permit that device to open an SSH session to the target. That bar is lower than it sounds, because the point of a mesh is that its devices are allowed to reach each other.

A laptop, a build agent, a developer's home machine, a contractor's box: any of them is a starting point, and the rules that let them work are the rules the report abuses.

The name implies a worm, and the researcher's claim is that the chain could in principle spread at machine speed once started. No worm has been observed. The word describes a shape, not an event.

No CVE, no fix, and a disputed response

0 CVEs have been assigned. Tailscale has published no bulletin, and no patched version exists as of 26 October. Accounts of the vendor's position disagree, which is worth saying rather than choosing between: some reporting says Tailscale confirmed receipt and is working on fixes, other reporting says it has not confirmed the findings at all.

Both cannot be right and we cannot settle it.

What is not in dispute: this went out without a coordinated window. Readers who have followed the PHP Foundation's account of an embargo coming apart will recognise the argument on both sides, and it is not a new one.

Why the mesh makes it worse

A mesh VPN sells reachability. Every node can address every other node that policy allows, without a hub, without a concentrator, and with 0 appliances in the path to inspect what one node asks another for. The property that removes the bottleneck removes the choke point.

Which is why the access rules carry all the weight here, and why a flaw converting an approved rule into root privileges is worth attention even without a CVE.

We made a similar point about an orchestrator where the lowest built-in role reached superuser. The pattern is the same: the permission people grant without thinking is the permission that matters.

What to do

  • Narrow SSH access rules to specific pairs rather than broad groups. Per-pair grants are the control that most directly reduces this.
  • Turn off SSH port forwarding where you do not need it, because the headline finding runs through forwarding.
  • Review which devices are permitted to open SSH sessions to production hosts, and remove the ones that are there because it was convenient once.
  • Treat the Mac GUI build as out of scope for the SSH findings. Reporting says it does not act as an SSH server.
  • Do not rebuild your network over this today. Nobody has reproduced it publicly, and a measured response is not the same as no response.

What is not established

  • Whether the findings reproduce outside the researcher's lab. No independent confirmation has been published.
  • Tailscale's actual position, which is reported two different ways.
  • Whether any of this is being exploited. Nothing has been reported.
  • Whether the chain is genuinely wormable, which is a claim about what could happen rather than an observation.
  • Which findings affect which deployment shapes. Self-hosted headscale and the hosted service are not identical.
  • When a fix arrives, since no vendor timeline exists.

We have not read the report itself. Everything above is drawn from the reporting of it.