New research reveals security flaw that could give control over Tailscale devices

Security researcher Erica Windisch published the Tailworm report examining Tailscale and headscale.

Lab testing claims a compromised device can gain root access across reachable servers under specific conditions involving SSH port forwarding and access rules.

The report was published on October 25 by security researcher Erica Windisch of Cyberdione Labs and is based on three days of testing conducted in a lab environment. The research examined Tailscale in version 1.104.2 and headscale in version 0.29.5.

How the problem works in practice

Tailscale's login function directly identifies the device instead of checking the user's password or digital key, based on predefined access rules.

According to lab tests, if an attacker controls an authorized device, they could exploit the connection to connect to internal system communications points. In this way, they could gain full administrator privileges, read code files, or even trick the system into connecting new machines to their control.

READ ALSO

Speed ​​restrictions remain on Ukrainian military satellite internet despite Trump's urging of Musk

The researcher described the process as being able to spread automatically from device to device in the lab, at a speed of less than a second per step. However, other researchers have publicly questioned how easily such automatic spread can occur, while some have called the finding concerning administrator privileges serious.

What the company answers

Until the publication of the report, the company had not issued any official warning or released a fix update.

Mike Shaver, Tailscale's vice president of engineering, said the company received the report and was already looking into these areas with the help of outside experts.

What administrators can do

To protect networks until official information is available, the following measures are recommended:

• Reconsider connection rules to limit them to individual pairings between specific devices.
• Disable connection forwarding where it is not necessary.
• Remove any unused connection permissions.
• Enable automatic expiration of device connection keys.
• Devices that have been compromised should be immediately deleted from the central control system.
• Enable connection checking and automatic updates.

G

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr