Zero Radar
← feed
HighVulnerabilityupdated 27 Oct 2026, 14:11 UTC

Tailscale SSH flaws could let a hacked device gain root on other servers

If one computer on your Tailscale network is taken over by an attacker, they may be able to take full control of other servers it can reach. Tailscale says a fix is still being worked on for several flaws.

Partial fix3 independent sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?PartlyNot for every affected version · since 27 Oct 2026
How sure is this?3 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker gains a footholdTakes control of one device on the network
  2. 2Tailscale network pathAccess rules allow connection to target server
  3. 3SSH port forwarding usedEnabled setting lets the attack proceed
  4. 4Target server reachedAttacker reaches another server over SSH
  5. 5Root privileges gainedFlaw lets attacker escalate to root
  6. ResultAttacker gains root on other servers

What happened

Multiple unpatched vulnerabilities in Tailscale SSH allow privilege escalation to root when port forwarding is enabled and an attacker controls a device permitted by the network's access rules to reach the target; BleepingComputer reports almost a dozen flaws that could also steal credentials and crash servers.

Why it is dangerous: An attacker who controls one device can move sideways to servers they are allowed to reach and gain root access there, which can expose data and systems. Teams using Tailscale SSH with port forwarding are most at risk.

Are you affected?

You are affected if you use Tailscale SSH with port forwarding enabled and your access rules let some devices connect to servers that could be targeted from a compromised device.

Tailscale SSH (versions not specified in the provided material)

What to do

  1. Disable port forwarding in Tailscale SSH on any server where it is not strictly needed
  2. Tighten Tailscale access rules so only required devices can reach SSH on sensitive servers
  3. Watch for Tailscale's official patch announcement and update Tailscale as soon as a fixed version is released
  4. Review logs on servers reachable over Tailscale SSH for unusual root logins or forwarding activity

Timeline

  1. 25 Oct 2026, 00:59 UTC
    Publicly disclosed
  2. 25 Oct 2026, 17:44 UTC
    Reported by The Hacker News · The Hacker News
  3. 25 Oct 2026, 18:25 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 02:19 UTC
    Hacker News reported on it · Hacker News
  5. 27 Oct 2026, 14:11 UTC
    BleepingComputer reported on it · BleepingComputer
  6. 27 Oct 2026, 14:11 UTC
    A fix was published

Sources 3 reports, oldest first

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
ZR-4a815415 · ZR-eeae20ed
Disclosed
25 Oct 2026, 00:59 UTC
On Zero Radar
25 Oct 2026, 18:25 UTC (17 h after disclosure)
Last change
27 Oct 2026, 14:11 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Tailscale SSH flaws could let a hacked device gain root on other servers · Zero Radar