Cyberdione Labs has audited Tailscale v1.104.2 and headscale v0.29.5 and found root execution reachable from a single approved device. Testing ran this month against unmodified, released software on the researchers’ own systems and devices.
Five classes of finding cover the `tailscaled` agent, its embedded SSH server, the serve and funnel features, the DERP relay client, the headscale control server, the `gliderssh` library both build on, and the experimental `conn25` app connector. Each result was confirmed by reproduction in a lab environment.
Erica Windisch, Founder of Cyberdione Labs, said: “It is the opinion of the researchers that rapid awareness of these flaws will expedite remediation across impacted devices. These vulnerabilities were not introduced by the researchers, but were discovered with low effort.”
Tailscale SSH socket forwarding as root
The embedded SSH server runs inside `tailscaled` with root privilege. Unix-socket forwarding via `ssh -R` performs path checks and file operations as root, and a race combined with a missing privilege drop lets an ordinary approved session replace, dial, or delete privileged resources. Researchers obtained root execution on target servers, captured enrollment keys, and deleted root-owned files at arbitrary paths.
Reaching root takes a single approved device and one SSH policy rule. On a self-hosted headscale control server the bar is lower still, because forwarding is granted automatically on every accepted session and can’t be disabled.
Every SSH grant is root-equivalent in practice, including grants handed to engineering workstations and edge gateways that share a mesh with plant systems.
App connectors and internal LAN reach
`conn25` connectors translate traffic to an attacker-chosen destination without validating the true destination, and network ACLs aren’t consulted for that endpoint at all. A device holding the connector capability reaches cloud metadata services, internal LANs, and every service in a Kubernetes cluster.
Edge clusters joined to a mesh for remote maintenance expose cluster services and metadata credentials to any device the connector policy admits. The isolation operators expect at the plant boundary doesn’t hold once an approved connector is in the path.
Control server exhaustion and relay memory reads
An internet-reachable headscale control server accepts unauthenticated resource exhaustion, which produces crash loops and blocks new-device onboarding across the whole organisation. The DERP relay client performs an unbounded read of a malicious relay response and exhausts agent memory.
A TCP-forward-to-unix-socket path in `tailscale serve` lacks an HTTP path guard and carries a per-mount authorisation race, so a peer racing the mount check can expose remote administrative API access and let a minority of requests bypass app authorisation.
Automated spread follows from the SSH findings: policy-granted Tailscale SSH paired with the socket behaviour moves laterally to every device the policy permits, with no passwords, stolen keys, or user interaction. The lab measured under one second per hop.
Per-pair SSH grants were the single control that bounded the spread, and TPM or Secure Enclave-bound credentials prevent the identity theft that makes a compromise persist.
See also: Singtel and Ericsson target industrial 5G with five-year partnership
Want to learn more about the IoT from industry leaders? Check out IoT Tech Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including AI & Big Data Expo and the Cyber Security Expo. Click here for more information.
IoT News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
