Tailscale fixes SSH root flaws in 1.104.4; Docker image still old

Tailscale said early on October 28 that version 1.104.4 fixes flaws in Tailscale SSH that let a device allowed to connect to a server reach root on it. A researcher’s report called Tailworm made the flaws public. The Hacker News and ThaiCERT reported it before the fix.

If your team reaches servers over Tailscale SSH, one hacked laptop could have meant root on every server its rules allow. The packages are out. Not every install has them yet.

One trusted device was enough

Tailscale SSH decides who gets in from the tailnet’s access rules, not from passwords or keys. The Tailworm report, by Erica Windisch of Cyberdione Labs according to The Hacker News, tested version 1.104.2 and headscale 0.29.5 and listed 11 findings.

The worst sit in SSH forwarding. Per bulletin TS-2026-014, the root-run tailscaled process checked Unix socket paths by name, then opened them as root. A peer allowed to forward could reach root-only sockets “such as the Docker socket or the tailscaled local API.”

Three more bulletins cover other flaws. A memory flaw can crash tailscaled and cut every Tailscale connection on the machine. A Tailscale Serve bug allowed “full node takeover,” and an HTTP/2 bug mixed up permissions between Serve mounts.

In the lab, The Hacker News reports, the chain went further: it captured a device enrollment key and joined the attacker’s own machine to the network, on tailnets without Tailnet Lock.

The attacker needs a foothold first

Tailscale stresses the limits. Exploitation “requires an existing foothold on an authorized peer in the tailnet, with SSH access explicitly permitted in the tailnet policy file.” It rejects the worm label and calls it “lateral movement limited to connections allowed by a tailnet policy file.” Conn25, the app connector feature named in the report, has not been released.

We think that limit is real but narrow. A foothold is one phished laptop or one poisoned package away, two of the routes the report itself names. On an unpatched machine that allows forwarding, each SSH rule that device holds was then a path to root.

Containers lag behind

We checked Tailscale’s own download index at 05:40 UTC on October 28. pkgs.tailscale.com lists 1.104.4 for Linux, Windows and macOS packages, but gives the container version as 1.104.2. On Docker Hub, the stable and latest tags were last updated on October 21, and a v1.104.4 tag did not exist. The changelog still showed 1.104.2 as the newest client.

So at the time of our check, a container setup that pulls stable on restart got the vulnerable build.

What to do now

• Find old clients. In the admin console, open the Machines page and filter the Version column by “Update available”; a red arrow marks a security update, per Tailscale’s update docs.
• Update servers first to 1.104.4, starting with machines that accept Tailscale SSH and run Docker.
• Turn off forwarding where you cannot update, including containers: set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart. Tailscale says this “mitigates several of the more serious findings” without disabling SSH. The trade-off is that ssh -L and ssh -R tunnels stop working.
• Narrow your SSH rules to named source and destination pairs, and turn on check mode for root logins. The report found per-pair rules stopped the spread in testing; check mode only adds a login step.
• On headscale, update the clients too: the fixes are in the Tailscale client, and the report lists its headscale-side items as pending.

Sources

• Tailscale, “Tailscale SSH: Findings and fixes,” October 28, 2026: https://tailscale.com/blog/tailscale-ssh-findings-fixes
• Tailscale security bulletins TS-2026-014 to TS-2026-017, October 26, 2026: https://tailscale.com/security-bulletins
• Tailscale, “Tailscale SSH: Investigation and remediation update,” October 26, 2026: https://tailscale.com/ssh-investigation-update
• Cyberdione Labs, Tailworm security assessment report, updated October 27, 2026: https://tailworm.com/
• The Hacker News, “Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers,” October 2026: https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
• ThaiCERT, “Tailscale SSH Vulnerability Could Allow Privilege Escalation and Root Access to Servers,” October 26, 2026: https://www.thaicert.or.th/en/2026/10/26/tailscale-ssh-vulnerability-could-allow-privilege-escalation-and-root-access-to-servers/
• Tailscale stable package index, checked October 28, 2026, 05:40 UTC: https://pkgs.tailscale.com/stable/?mode=json
• Docker Hub, tailscale/tailscale tags, checked October 28, 2026: https://hub.docker.com/r/tailscale/tailscale/tags
• Tailscale docs, “Update Tailscale”: https://tailscale.com/docs/features/client/update