Mmastodon TechnologyCybersecurity first seen 3 d ago, last 3 d ago, peak #9

Unpatched Tailscale SSH flaw lets lateral root access spread across networks

Original: 🤖 Unpatched Tailscale SSH privesc: a foothold on one tailnet device can yield root on every server its ACLs allow, no ke

Security researchers at Cyberdione Labs, in a project called Tailworm, report an unpatched privilege escalation in Tailscale SSH: compromising a single device on a tailnet can yield root access on every server its access-control rules permit, without needing SSH keys. They tested Tailscale 1.104.2 with Headscale 0.29.5, finding no CVE or fix so far, with only strict per-pair ACLs stopping the spread in their lab.

Why now: The flaw is reportedly unpatched and could expose entire server fleets to attackers who compromise one device, prompting security teams to reassess their tailnet ACL configurations.

TailscaleCyberdione LabsHeadscaleTailworm

Open on mastodon →

Evidence

• 🤖 Unpatched Tailscale SSH privesc: a foothold on one tailnet device can yield root on every server its ACLs allow, no keys needed. Tailworm (Cyberdione Labs) tested 1.104.2 + headscale 0.29.5: no CVE, no patch. Only per-pair ACLs stopped the lab spread. 🔗 https://… · cloud@infosec.exchange · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/3705711