Xavfsizlik tadqiqotchilari Tailscale va Headscale'dagi bir nechta yuqori darajadagi zaifliklarni oshkor qildilar, bu zaifliklar hujumchilarga ulangan serverlarda root huquqini olish, tarmoq xavfsizligi siyosatlarini chetlab o'tish, ma'lumotlarni o'g'irlash va masofaviy kirish infratuzilmasini buzish imkonini berishi mumkin.
Cyberdione Labs'dan Erica Windisch bu topilmalarni Tailworm nomli xavfsizlik tadqiqot hisobotida e'lon qildi. Baholash 2026-yil 22-oktabrdan 24-oktabrgacha Tailscale 1.104.2 va headscale 0.29.5 versiyalarini o'rganib chiqdi.
Tadqiqotchilar bitta qurilmani nazorat qilgan hujumchi qo'shimcha parollar, SSH kalitlari yoki administrator huquqlarisiz Tailscale SSH orqali kirish mumkin bo'lgan boshqa serverlarni buzishi mumkinligini ko'rsatdilar.
Bu hujumlar mavjud SSH kirish ruxsatlari va port-yo'naltirish (port-forwarding) imkoniyatlariga tayanadi. Tadqiqotchilar zaifliklarni ishlab chiqarish tarmoqlarida emas, balki nazorat qilinadigan laboratoriya muhitlarida takrorladilar.
Asosiy xavfsizlik muammosi Tailscale SSH Unix-domen soket yo'naltirishni o'zining imtiyozli tailscaled jarayoni orqali qanday boshqarishida yotadi. An'anaviy OpenSSH o'rnatishlaridan farqli o'laroq, imtiyozlar ajratishdan foydalanadi, Tailscale'ning o'rnatilgan SSH serveri ba'zi yo'naltirish operatsiyalarini root huquqlari bilan bajaradi.
Tadqiqotchilar ichki T3 deb kuzatilgan zaiflikni aniqladilar. Bu muammo ssh -L buyrug'i bilan mahalliy Unix soket yo'naltirish autentifikatsiya qilingan tengdoshga odatda root bilan cheklangan soketlarga kirish imkonini berganda yuzaga keladi.
Sinovlar davomida tadqiqotchilar bu xatti-harakatdan foydalanib imtiyozli Docker soketi bilan aloqa o'rnatdilar va root ruxsatlari bilan buyruqlarni bajardilar. Ular Linux parol ma'lumotlarini o'z ichiga olgan /etc/shadow fayliga muvaffaqiyatli kirishdi.
Boshqa zaiflik, T2 deb belgilangan, ssh -R buyrug'i orqali masofaviy soket yo'naltirishni o'z ichiga oladi. Bu zaiflik imtiyozli jarayonga root egalik qiladigan Unix soketlarini hujumchi nazoratidagi tinglovchilar bilan almashtirishga imkon beradi, bu esa buyruq bajarish, xizmatni soxtalashtirish va Docker registr ma'lumotlarini ushlab qolish imkonini berishi mumkin.
Bundan tashqari, bog'liq vaqt-tekshirishdan-vaqt-foydalanish (TOCTOU) poyga sharti hujumchilarga sezgir tizim resurslarini himoya qilish uchun mo'ljallangan fayl yo'li cheklovlarini chetlab o'tishga imkon beradi.
Hisobot shuningdek, hujumchilar ulangan tizimlar bo'ylab avtomatlashtirilgan yonma-yon harakatni qanday amalga oshirishi mumkinligini ko'rsatadi. Ishonchli qurilma identifikatorlari va keng ruxsat berilgan SSH kirish qoidalaridan foydalanib, hujumchilar qo'shimcha foydalanuvchi aralashuvisiz kirish mumkin bo'lgan mashinalar o'rtasida harakatlanishi mumkin.
Tadqiqotchilar laboratoriya sharoitida tarqalish har bir sakrashda bir soniyadan kamroq vaqt ichida sodir bo'lishi mumkinligini ko'rsatdilar.
Qo'shimcha topilmalar Tailscale'ning eksperimental conn25 ilova ulanishi (app connector) bilan bog'liq xavotirlarni ochib beradi, bu ruxsat berilgan qurilmalarga kutilmagan ichki xizmatlarga, bulut metadata nuqtalariga va Kubernetes resurslariga kirish imkonini berishi mumkin.
Baholash shuningdek, headscale va Tailscale komponentlariga ta'sir qiladigan xotira tugashi zaifliklarini aniqladi, bu qurilma ro'yxatdan o'tkazish va tarmoq mavjudligini buzishi mumkin.
Administratorlar darhol Tailscale SSH ruxsatlarini ko'rib chiqishlari, ulanishlarni aniq manba va maqsad qurilmalariga cheklashlari va keraksiz port-yo'naltirish imkoniyatlarini o'chirishlari kerak. Headscale 0.29.5 versiyasidan foydalanadigan tashkilotlar qo'shimcha xavotirga duch keladilar, chunki bu versiya SSH yo'naltirishni mustaqil ravishda o'chirishni qo'llab-quvvatlamaydi.
Tadqiqotchilar ilova ulanish ruxsatlarini cheklash, maqsad ruxsat ro'yxatlarini joriy etish, shubhali qurilma ro'yxatdan o'tkazishlarini kuzatish va qurilma ma'lumotlarini apparat asosidagi xavfsizlik choralari orqali himoya qilishni tavsiya qiladilar.
2026-yil 25-oktabrdagi hisobotga ko'ra, bu zaifliklar uchun hech qanday CVE identifikatorlari yoki tuzatilgan versiyalar e'lon qilinmagan. Tailscale tadqiqotni tan olgan va aniqlangan muammolarni hozirda o'rganmoqda.
Bu kashfiyot imtiyozli SSH operatsiyalaridagi zaifliklar qanday qilib buzilgan qurilmani kengroq server buzilishlari uchun darvozaga aylantirishi mumkinligini ta'kidlaydi, hatto nol ishonch (zero-trust) xavfsizlik tamoyillari atrofida qurilgan tarmoqlarda ham.
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastructure.
Erica Windisch of Cyberdione Labs published these findings in a security research report titled Tailworm. The assessment examined Tailscale version 1.104.2 and headscale version 0.29.5 between October 22 and October 24, 2026.
Researchers demonstrated that an attacker controlling a single device could potentially compromise other servers accessible through Tailscale SSH without needing additional passwords, SSH keys, or administrator privileges.
These attacks rely on existing SSH access permissions and port-forwarding capabilities. Researchers reproduced the vulnerabilities in controlled laboratory environments rather than production networks.
The main security issue lies in how Tailscale SSH manages Unix-domain socket forwarding through its privileged tailscaled process. Unlike traditional OpenSSH deployments that utilize privilege separation, Tailscale’s embedded SSH server performs certain forwarding operations with root privileges.
Researchers identified a vulnerability tracked internally as T3. This issue arises when local Unix socket forwarding with the command ssh -L allows an authenticated peer to access sockets that are normally restricted to root.
During testing, researchers exploited this behavior to communicate with a privileged Docker socket and execute commands with root permissions. They successfully accessed /etc/shadow, which contains sensitive Linux password information.
Another vulnerability, designated T2, involves remote socket forwarding via the ssh -R command. This vulnerability allows the privileged process to replace root-owned Unix sockets with attacker-controlled listeners, potentially enabling command execution, service impersonation, and interception of Docker registry credentials.
Additionally, a related time-of-check-to-time-of-use (TOCTOU) race condition lets attackers bypass file-path restrictions meant to protect sensitive system resources.
The report also illustrates how attackers could automate lateral movement across connected systems. By exploiting trusted device identities and permissive SSH access rules, attackers could move between accessible machines without requiring further user interaction.
The researchers demonstrated that propagation could occur in less than one second per hop under laboratory conditions.
Further findings reveal concerns regarding Tailscale’s experimental conn25 app connector, which could allow authorized devices to access unintended internal services, cloud metadata endpoints, andKubernetes resources.
The assessment also uncovered memory-exhaustion vulnerabilities affecting both headscale and Tailscale components, which could disrupt device registration and network availability.
Administrators should immediately review Tailscale SSH permissions, restrict connections to specific source and destination devices, and turn off unnecessary port-forwarding capabilities. Organizations using Headscale version 0.29.5 face additional concerns, as this version does not support disabling SSH forwarding independently.
Researchers recommend limiting app connector permissions, enforcing destination allowlists, monitoring suspicious device enrollments, and protecting device credentials through hardware-backed security measures.
As of the report on October 25, no CVE identifiers or fixed versions have been announced for these vulnerabilities. Tailscale has acknowledged the research and is currently investigating the identified issues.
This discovery highlights how weaknesses in privileged SSH operations can turn a compromised device into a gateway for broader server compromises, even within networks designed around zero-trust security principles.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.