Tailscale SSH Tailworm: what the fix in 1.104.4 closes
Four developer stories from Wednesday, October 28, 2026, each read from its own primary source. The lead is Tailscale SSH and the report called Tailworm: a researcher said an authorized SSH session could reach sockets only root should touch, and Tailscale shipped fixes in version 1.104.4. The video has the full walkthrough; this article keeps the quotes, numbers and links in one place. TL;DR…
Tailscale SSH vulnerability, dubbed "Tailworm," affects Unix socket forwarding performed as root within the tailscaled process. Researchers from Cyberdione Labs discovered the issue, reporting it to Tailscale on October 24, 2026. Tailscale patched the vulnerability in version 1.104.4, addressing problems with local and remote forwarding, as well as a race condition.
To mitigate the vulnerability on macOS, users can set the TS_SSH_DISABLE_FORWARDING environment variable to 1 or update to Tailscale 1.104.4. However, some macOS tools, including git, curl, and python3, still accept certificates from compromised eMudhra intermediates as of October 28, 2026, despite Apple blocking them in Safari, Mail, and apps that use Apple's networking and security frameworks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
