Unpatched Tailscale SSH flaws could let a hacked device reach root on other servers

A Cyberdione Labs report describes laboratory tests of Tailscale SSH and headscale in which a device controlled within a Tailscale network could, under certain configurations, reach root access on other servers. The attack first requires compromising one permitted device and having Tailscale SSH port forwarding enabled. The tests used Tailscale version 1.104.2 and headscale version 0.29.5; the findings have not been confirmed on real networks. At publication, there was no security bulletin, CVE, or fixed version.