# Researcher reports Tailscale SSH flaws that could expose reachable servers to root access

_Published Sunday, October 25, 2026 at 4:06 PM EDT · Security · Latest · Tier 2 — Notable_

![Researcher reports Tailscale SSH flaws that could expose reachable servers to root access — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbGR63RmXInXPwCVFZlGJSiGv5WQfLTWymToOPIYbKXfXniB7X4YDbTVK-28G4r3WfdelCr_2TRzhoYrIogcG_C9WjXEHaLhURIh_v5RyO5sBY8UKwQWbKUBrv_H5n5K7N4mz2WG3d5dldw_re-M5CgDDbVi_EhTqvB9P87fZJlODojj8ivvj-RwLUhpg/s1700-nu-rw-lo-l85-e365/tailscale.jpg)

Security researcher Erica Windisch reported that a compromised device could gain root access to reachable servers when Tailscale SSH permits port forwarding. Her October 25 Tailworm report describes laboratory tests of Tailscale 1.104.2 and headscale 0.29.5, rather than attacks on real networks.

The tests used forwarding to make a privileged Tailscale process access protected system sockets. Rules restricting access to individual device pairs stopped the spread in testing. Hosted Tailscale permits administrators to disable forwarding per rule; headscale 0.29.5 does not.

Tailscale says it has found issues and is working on fixes, but has not confirmed the specific technical claims. No fixed version was available at publication.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html)

---
Canonical: https://techandbusiness.org/newswire/-vqw3rT3KzPSFaw4O2MB2h
Published: 2026-10-25T20:06:15.689Z
Story chronology: 2026-10-25T17:44:09.000Z
Retrieved: 2026-10-25T22:55:10.401Z
Publisher: Tech & Business (techandbusiness.org)