Tailscale SSH Flaws Let One Hacked Device Reach Root on Other Servers

· Cybersecurity

A security researcher published findings showing that a single compromised device on a Tailscale network can be used to gain root access to other servers it can reach. The attack needs two conditions: Tailscale SSH configured to allow port forwarding, and an attacker who already controls one device on the network. The flaws are described as unpatched, meaning organizations running Tailscale SSH with port forwarding enabled have no vendor fix to apply yet. Tailscale is widely used to build private mesh networks linking servers and staff devices, so a foothold on one machine can expose many internal systems. The immediate effect is that defenders should review whether port forwarding is enabled and treat any single compromised host as a potential path to root elsewhere.

Why it matters：Zero-trust networking tools are now attack surface of their own; if these flaws remain unpatched, one compromised endpoint can yield root across a whole mesh.

Key points

  • The attack requires Tailscale SSH set to allow port forwarding.
  • The attacker must already control one device on the network.
  • The flaws are described as unpatched.

Sources (original reporting)

More stories from this day