Tailscale users: update to 1.104.4. A researcher published 11 flaws ("Tailworm") on October 25 without warning Tailscale first. The worst are in Tailscale SSH: a compromised device with a single SSH policy rule could get root on other machines in the tailnet. Tailscale called them "serious", and fixed them in 1.104.4 (bulletins TS-2026-014 to 017).
Can't update yet? Set TS_SSH_DISABLE_FORWARDING=1 in tailscaled's environment and restart, and tighten your SSH rules. Self-hosting headscale? Reports say it's still unpatched.
https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-29 10:29:18 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aPublished at
2026-10-29 10:29:18 UTCEvent JSON
{
"id": "787b88491bac5432d2a01db4b7b01b6fa933625c5a2faa2f9626ab8f4759a106",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1793269758,
"kind": 1,
"tags": [],
"content": "Tailscale users: update to 1.104.4. A researcher published 11 flaws (\"Tailworm\") on October 25 without warning Tailscale first. The worst are in Tailscale SSH: a compromised device with a single SSH policy rule could get root on other machines in the tailnet. Tailscale called them \"serious\", and fixed them in 1.104.4 (bulletins TS-2026-014 to 017).\n\nCan't update yet? Set TS_SSH_DISABLE_FORWARDING=1 in tailscaled's environment and restart, and tighten your SSH rules. Self-hosting headscale? Reports say it's still unpatched.\n\nhttps://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/",
"sig": "8d0795b0dc7d426a5d021cbc0ea83f844b0c4be2d346fa8cdd08c687a7bfd8215fbdc17b6ea8484142719dd184b89fa4cae22cbeae5712a6775ddc1d2de3e566"
}