A recent report has raised significant concerns regarding vulnerabilities in Tailscale’s SSH implementation, potentially allowing a compromised device to gain root access to other servers within the same network. Erica Windisch of Cyberdione Labs published her findings on October 25, detailing how specific configurations could enable attackers to exploit these flaws without needing stolen credentials.
The vulnerabilities hinge on two critical conditions: Tailscale SSH must be configured to allow port forwarding, and the attacker must already control at least one device within the network that has permission to connect to the target server. Windisch’s tests were conducted on Tailscale version 1.104.2 and headscale version 0.29.5, which is a self-hosted alternative to Tailscale’s service, over a three-day period in a controlled lab environment.
As of the report’s publication, Tailscale had not issued any security bulletins or CVE identifiers related to these vulnerabilities. In response to the findings, Mike Shaver, Tailscale’s vice president of engineering, acknowledged the report on Reddit, stating that the company was already investigating similar issues with external security experts and was working on fixes. He emphasized that Tailscale is not recommending users disable SSH at this time.
Mechanics of the Vulnerability
The Tailscale SSH system operates differently from traditional SSH servers. Instead of authenticating users via passwords or keys, it identifies devices based on access rules. This design means that once an attacker gains access to one device, they can exploit the vulnerabilities to escalate privileges on other connected devices without needing to steal passwords or keys. The report outlines several methods of attack, including:
- Using standard SSH port forwarding to connect to a system socket that should only be accessible to root, allowing immediate access to sensitive files.
- Replacing a root-owned socket with the attacker’s own, enabling direct command execution at the root level.
- Bypassing safety checks that limit file access, which could allow an attacker to capture keys used for enrolling new devices and add their own device to the network.
Windisch characterized the potential for these vulnerabilities to spread as “wormable,” indicating that a single compromised device could rapidly infect others within the network, provided the access rules allow it. However, this spread was only demonstrated in a lab setting, and real-world conditions may vary.
Recommendations for Mitigation
In light of these vulnerabilities, Windisch and Tailscale have provided several recommendations for network administrators to mitigate risks:
- Review and tighten Tailscale SSH access rules to ensure they are defined as single source-to-destination pairs, eliminating broad access rules.
- Disable SSH port forwarding wherever possible. On Tailscale’s hosted service, this can be done on a per-rule basis, while on headscale version 0.29.5, it cannot be disabled.
- Limit app connector permissions to only those devices that require them.
- Disable any Tailscale serve forward that points to a Unix socket.
- Enable node-key expiry to prevent stolen device keys from remaining valid indefinitely.
- If a device is compromised, remove it from the control plane to revoke any keys that may have been copied by an attacker.
Tailscale also suggests enabling SSH check mode, which adds an additional login step before a session begins, although this does not address the underlying privilege escalation issue.
As the situation develops, cybersecurity professionals are advised to stay informed about updates from Tailscale and to implement the recommended security measures to protect their networks. For further details, refer to the full report published by Windisch on Tailworm.
For ongoing coverage of global cybersecurity developments, visit our Global cybersecurity section.
