A researcher published bugs in Tailscale SSH, a feature of the Tailscale app. Some people who are already allowed to connect could get more power than they should. Tailscale fixed these bugs in version 1.104.4 and posted four notices about them (TS-2026-014 to TS-2026-017). Update Tailscale to 1.104.4 or newer.
- Status
- Patched: update now
- Being attacked?
- Not known[1]
- Severity
- High
- Updated
Tailscale's notices do not say anyone is using these bugs. Severity: Tailscale calls them 'serious security issues'. No score published. First reported .
Am I affected?
This is mostly about the Tailscale SSH and Tailscale Serve features. If you never turned them on, this probably does not apply to you. Still, update Tailscale to 1.104.4 or newer to be safe.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Tailscale | Windows | Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve) | 1.104.4[2] |
| Tailscale | Mac | Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve) | 1.104.4[2] |
| Tailscale | Linux | Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve) | 1.104.4[2] |
How to check your version
These checks only look. They do not change anything on your computer.
Tailscale on Windows
Easy way: Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
tailscale version
Tailscale on Mac
Easy way: Click the Tailscale icon in the menu bar > About Tailscale.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
tailscale version
Tailscale on Linux
Easy way: Open the app and look in its Help or About menu, or check your software manager.
How to fix it
- Update Tailscale to version 1.104.4 or newer (the Tailscale icon > check for updates, or download it from the official site).
- If you use Tailscale SSH: limit who can connect to only the people and devices that need it.
More on each app: Is my Tailscale up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/tailscale-ssh-flaws-tailworm.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): None
Sources
- MakerTailscale: SSH investigation and remediation update (Oct 26, 2026)
- MakerTailscale security bulletins TS-2026-014 to TS-2026-017 (fixed in 1.104.4) (Oct 27, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.