Tailscale Team submits SSH redesign proposals; researcher discloses 11 security issues

AT A GLANCE

The researcher said that Tailscale and headscale have 11 security issues; some attack chains may escalate privileges to root, and an official fix has not yet been released.

Article

Tailscale Exposed 11 security issues: installing a security door on the server may instead let hackers take the master key

Beating AI Briefing: Recently, many developers have suggested that one of the best ways to protect VPS is to close the public-network SSH entry point and switch to Tailscale remote access.

As a result,October 25, security researcher Erica Windisch released a report called Tailworm, finding Tailscale security issues in 11 and its open-source alternative headscale. The most serious scenario arises precisely from the built-in Tailscale feature of SSH.

An attacker does not need to compromise VPN. As long as they control a device authorized to access the target server through Tailscale SSH and SSH forwarding permissions are enabled, they may further obtain root privileges on the server.

The vulnerability lies in privilege isolation: the Tailscale backend runs as root, and some SSH forwarding operations also inherit those privileges. In experiments, the researcher used Unix Socket forwarding to bypass ordinary-account restrictions and successfully obtained root privileges on the server through Docker.

Another attack chain also intercepted a device registration key and added a spoofed server to a test network where Tailnet Lock was not enabled.Tailscale only fixed a June forwarding authorization-bypass vulnerability in SSH earlier this year. In the same month, it also closed a vulnerability allowing root access through the numeric user Unix Socket`;ID `0` to obtain root;July also fixed an issue in which the special username `-i` bypassed permission restrictions. Several months later, the researcher again found a privilege-escalation path in the forwarding mechanism of the same built-in SSH.Tailscale Vice President of Engineering Mike Shaver subsequently acknowledged that the team had identified privilege-boundary violations following SSH authorization, but had not yet confirmed all conclusions in the research report, nor did it recommend that all users directly disable Tailscale SSH。

October 25. The engineering team submitted multiple SSH redesign proposals on GitHub in succession, intending to have forwarding operations use the privileges of the actual logged-in user rather than executing them directly through the root process. The relevant fixes have not yet been released in an official version.

Original link https://m.theblockbeats.info/flash/373644

Key points

October 25, security researcher Erica Windisch released a report called Tailworm.
The report states that Tailscale and its open-source alternative headscale contain 11 security issues.
The article states that when an attacker controls a device authorized to access the target server through Tailscale SSH and SSH forwarding permissions are enabled, they may further obtain root privileges on the server.
The researcher said they used Unix Socket forwarding to bypass ordinary-account restrictions and obtained root privileges on the server through Docker.
Another attack chain intercepted a device registration key and added a spoofed server to a test network where Tailnet Lock was not enabled.
Tailscale Vice President of Engineering Mike Shaver acknowledged that the team had identified privilege-boundary violations following SSH authorization, but had not yet confirmed all conclusions in the research report.
October 25, the engineering team submitted multiple SSH redesign proposals on GitHub, and the relevant fixes have not yet been released in an official version.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Tailscale is commonly used to remotely connect devices. This report focuses on the privilege isolation of its built-in SSH: the backend runs as root, while some forwarding operations also inherit those privileges. Under specific conditions, an attacker who has already compromised an authorized device may use this to break through ordinary-account restrictions and obtain the server's highest privileges.

Why it matters to readers

If the attack chain is viable, a device originally authorized for limited SSH access could become an entry point for further control of the server. Root privileges give an attacker the highest level of operational capabilities on the server, while the current materials state that an official fixed version has not yet been released.

Users new to managing Tailscale SSH or servers should pay attention to official fixes, the range of affected versions, and VPS forwarding permissions; the original article does not recommend that all users directly disable SSH.Tailscale SSH。

Risks and unknowns

Tailscale It has not yet confirmed all conclusions in the research report.
The original article does not specify the exact range of affected versions.
The original article does not state whether these issues have been exploited by attackers in real-world environments.
The specific attack conditions and remediation status of the headscale-related issue have not been specified.

Tailscale Team submits SSH redesign proposals; researcher discloses 11 security issues

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center