Security AlertHigh
Tailscale flaw could let one hacked device reach root on others
Oct 25, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
A researcher says a compromised device on a Tailscale network could be used to reach root on other servers it can access. Tailscale has not issued a bulletin, CVE or fix yet.
Key points
- The report says Tailscale SSH port forwarding is part of the risk.
- Tested versions were Tailscale 1.104.2 and headscale 0.29.5.
- The researcher described the issue as potentially wormable.
- Tailscale says it is working with outside specialists on fixes.
Why it matters
If your team uses Tailscale, one compromised device could create a bigger internal risk than expected. Small businesses should review SSH and forwarding settings and watch for vendor updates.
Who’s affected: Tailscale and headscale users
What to do
- Review Tailscale SSH and port-forwarding settings.
- Limit access rules where possible.
- Watch for a Tailscale security bulletin or fix.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.