{
  "id": 16511953,
  "title": "Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers",
  "url": "https://urgent.news/2026/10/25/unpatched-tailscale-ssh-flaws-could-let-a-hacked-device-reach-root-on",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T17:44:09.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html"
  },
  "original_language": "en",
  "account": "A recently uncovered vulnerability in Tailscale SSH could enable a compromised device within a network to gain root access to other servers reachable by that device, according to a security researcher's findings. The attack hinges on two prerequisites: Tailscale SSH must be configured to enable port forwarding, and an attacker must already control at least one device within the network that is permitted to connect to the target server. This report, titled \"Tailworm,\" was authored by Erica Windisch of Cyberdione Labs and details the discovery, which was conducted in a lab environment using Tailscale version 1.104.2 and headscale version 0.29.5. As of the publication date, Tailscale has not issued a security bulletin, CVE identifier, or provided a fixed version.\n\nWindisch's tests revealed that when an attacker has a foothold on a single device, they can exploit the SSH setup to achieve root-level access on other servers within the network, without the need for stolen passwords or keys. This is due to Tailscale SSH's device-centric identification system and its reliance on a single access rule to determine whether a device can connect to a target. Notably, Tailscale SSH does not require stolen credentials to exploit, as it identifies the device itself. To successfully execute the attack, an attacker typically requires a foothold on one device, which can be gained through typical means such as vulnerable web applications, poisoned software packages, phishing, or stolen login details.",
  "summary": "A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}