Tailworm

What happened

Researchers from Cyberdione Labs audited Tailscale version 1.104.2 and headscale version 0.29.5. Tailscale is a tool that connects devices into a private network. Headscale is a self-hosted server that runs the control side of that network. The researchers say the tools were built to be secure, but they found many weak spots. They tested the flaws in a lab on the released software and say they can be reproduced.

Key numbers and facts

• The audit covered 5 classes of findings, with labels T1 to T3, C1 to C4, and F-1 to F-5.
• The testing window ran from October 22 to October 24, 2026.
• One approved device plus one SSH rule was enough to start the main SSH attack on some setups.
• Some attacks could reach cloud metadata, which can hold login secrets.
• The software is released under the BSD-3 license, which comes with no warranty.

Some background

Tailscale is made by a for-profit company, Tailscale Inc. The researchers say they are not linked to that company and were not paid for this work. Zero-trust means a system checks every connection and does not automatically trust anything inside the network. The researchers say these tools claim to offer this kind of protection, but the flaws break that promise.

Why it matters

Many companies and people use these tools to protect their networks and servers. If the flaws are real, attackers could take control of servers, steal keys, or stop new devices from joining. The researchers say they want fast public awareness so that users can fix their systems sooner. They also say the flaws were found with low effort, which means others may find them too.

What to watch

• Whether Tailscale and the headscale team confirm the bugs and release fixes.
• How quickly users update to new versions after any fix is released.
• Whether more details or reproduction kits are shared with the public.
• Whether the experimental conn25 connector feature is changed or removed.