The security team at Tailscale announced they are working on issuing urgent updates to address 11 newly discovered security vulnerabilities that could be exploited to steal credentials, disrupt servers, or gain full "root" privileges on affected systems. Tailscale is known for developing virtual private networks (VPNs) based on the WireGuard protocol, allowing users to connect computers, servers, and cloud instances over an encrypted peer-to-peer (P2P) network.
Details of the "Tailworm" Vulnerabilities Discovery
Cyberdione Labs discovered these vulnerabilities, dubbed "Tailworm," during a security audit of Tailscale version 1.104.2 and the self-hosted control server headscale version v0.29.5. Erika Windisch, the founder of the lab, confirmed that these vulnerabilities were verified in a laboratory environment on unmodified software, noting that their discovery did not require a significant effort, which calls for immediate remediation by users.
The discovered vulnerabilities are distributed across several critical components. In addition to a built-in SSH server vulnerability that allows remote code execution with root privileges, the "App Connectors" component suffers from a flaw that permits routing traffic to destinations chosen by the attacker without validating Access Control Lists (ACLs), potentially leading to credential theft from cloud environments or access to internal local networks. Furthermore, an issue was identified in the DERP relay client, where a malicious relay can cause client memory exhaustion.
What Changes Practically for Users?
Tailscale acknowledged the severity of these vulnerabilities, explaining that their exploitation depends on the permissions granted to the user or connected device, and the system configuration. However, the company did not advise completely disabling the Tailscale SSH feature, instead proposing immediate precautionary measures to mitigate risks until final updates are released. These measures include:
- Reviewing Access Policies: Restricting SSH access exclusively to users and devices that genuinely require it.
- Disabling SSH Forwarding: If not needed, the environment variable (TS_SSH_DISABLE_FORWARDING=1) can be set in the tailscaled service and restarted, which disables forwarding and closes one of the most significant attack vectors.
- Temporarily Tightening Policies: Reviewing and strictly restricting access to sensitive systems during the investigation and remediation period.
The company is expected to release the necessary security updates addressing all of these vulnerabilities by the end of the day on Tuesday, October 27. The company urged all system administrators and users to prepare to update their applications as soon as the new version becomes available to ensure the protection of their technical infrastructure from any exploitation attempts targeting these serious vulnerabilities.