Tailscale 1.104.4 fixes the confirmed SSH and Serve vulnerabilities discussed in the Tailworm report. An attacker with access to an authorized tailnet device could cross local user privilege boundaries on servers it was already allowed to reach through Tailscale SSH. Update those servers first, then review Serve deployments and SSH policies. Tailscale published four security bulletins on 28 October 2026.
Reflects what was publicly known on the last updated date. Every fact links to a primary source at the end of the page.
Reviewed on 5 November: Tailscale 1.104.4 or later remains the fix for TS-2026-014 through TS-2026-017. The Tailscale changelog lists 1.104.5 on 2 November as a maintenance release with further SSH reliability fixes. headscale 0.29.7 followed on 30 October with fixes for the report's control-server findings. The bulletins still list no CVE identifiers, and the sources cited here do not report exploitation in the wild.
You run Tailscale SSH servers
Including servers that only allow non-root logins
Update each server to 1.104.4 or later. Review which peers can connect, and temporarily disable forwarding where you cannot patch yet.
You use Serve with Unix sockets or distinct app capabilities
Unix backend forwards, or TLS mounts with different permissions
Update the Serve node to 1.104.4 or later. Review local users' ability to change backend paths or Serve configuration.
You use headscale
Self-hosted coordination with Tailscale clients
Upgrade headscale to 0.29.7 or later for the control-server fixes, and update server-side Tailscale clients to 1.104.4 or later. Neither update replaces the other.
You use standard OpenSSH over Tailscale
sshd accepts the connections; Tailscale carries the traffic
These Tailscale SSH findings do not apply to that server. Check any separate use of Tailscale Serve and continue routine client updates.
# On each server: inspect SSH preferences and the running daemon version.
tailscale debug prefs
tailscale version --daemon
# Look for RunSSH: true in the preferences.
# Verify the daemon is 1.104.4 or later after updating.The 1.104.4 release is now available. The earlier advice to wait for a patch is superseded.
| Bulletin | Impact and conditions | What changed |
|---|---|---|
| TS-2026-014 | Authorized SSH forwarding could reach or replace root-only Unix sockets, including through a path race. Non-root login restrictions did not confine these operations. | Socket operations run with the authenticated user's privileges. |
| TS-2026-015 | An authorized SSH session could exhaust daemon memory through window-change and environment messages, disrupting all Tailscale networking on the host. | Session allocations are bounded and released after disconnect. |
| TS-2026-016 | Serve Unix backends could expose the local API or other privileged sockets. Exploitation depends on control of Serve configuration or writable backend paths. | Local API TCP forwarding is restricted and backend checks run on every connection. |
| TS-2026-017 | Concurrent HTTP/2 streams could mix app capability headers across Serve TLS mounts with different permissions. | Capabilities are derived separately for each request. |
Tailscale now endorses setting TS_SSH_DISABLE_FORWARDING=1 in the service environment and restarting tailscaled. On Linux with systemd, use a service override:
sudo systemctl edit tailscaledAdd these lines in the editable override section:
[Service]
Environment=TS_SSH_DISABLE_FORWARDING=1Save the file, then reload and restart the service:
sudo systemctl daemon-reload
sudo systemctl restart tailscaledTailscale describes the SSH risk as lateral movement within existing access rules. An attacker needs an initial foothold and policy-permitted SSH access; the findings do not bypass tailnet authentication. SSH check mode guards session admission and does not repair privilege handling within an approved session.
The vendor also distinguishes the unreleased Conn25 app connector from stable app connectors, which it says are unaffected by that finding. Do not apply the report's broader app-connector claims to production connectors without that qualification.
headscale is a separate control server. Its 0.29.7 release fixes the report's headscale findings, including bounds on pending registrations and authentication state, and updates its Tailscale dependency to 1.104.4. Its release notes state that upgrading headscale alone does not apply the client-side fixes. Update tailscaled on SSH servers regardless of which control server you use.
If you suspect compromise, preserve host and control-plane logs, inspect unexpected device registrations and policy changes, revoke affected device access, and rotate exposed credentials from a clean machine. A software update does not revoke stolen credentials or establish whether a host was previously compromised. The vendor disclosures cited here do not establish exploitation in the wild.
Tailscale 1.104.4, released on 28 October 2026, fixes the confirmed SSH and Serve issues in TS-2026-014 through TS-2026-017. Version 1.104.5, released on 2 November 2026, is a later maintenance release that also contains them. Update the server-side tailscaled process and affected Serve nodes, rather than only the laptop used to connect. Version 1.104.2 does not contain these fixes.
The confirmed SSH findings require a foothold on an authorized device and an SSH connection permitted by your tailnet policy. They do not let an anonymous internet user connect to arbitrary servers. Once a connection is authorized, vulnerable forwarding can reach sockets beyond the local user's permissions.
Neither repairs the forwarding privilege boundary. Restricting local usernames and requiring check mode can reduce access, but the forwarding flaw operates inside an already authorized session. Upgrade even if both controls are enabled.
Tailscale endorses setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. This disables SSH forwarding while retaining Tailscale SSH. It breaks SSH tunnels and does not fix the separate session memory-exhaustion or Serve issues. Upgrade to 1.104.4 or later.
The SSH findings concern Tailscale's built-in SSH server, rather than an OpenSSH server carried over the Tailscale network. Tailscale also says the app-connector finding concerns unreleased Conn25; stable app connectors are not affected by that finding. Separately configured Serve features still need review.
No. headscale 0.29.7, released on 30 October 2026, fixes the Tailworm findings in headscale itself, such as unbounded pending registrations. Its release notes state that the SSH, session and Serve fixes run in tailscaled on each node, so upgrading headscale alone does not apply them. Upgrade both.
Vulneron matches new vulnerabilities and public exploits against your live surface, confirms what is actually exploitable for you, and alerts in real time only when it is critical.