Tailscale zero-days spark a disclosure war before fixes land

A security researcher has sparked controversy after publicly disclosing 11 vulnerabilities in open-source VPN product Tailscale and its open-source alternative, Headscale, before security patches were available.

Erica Windisch warned in research published on Sunday that attackers could exploit weaknesses in Tailscale SSH to get root access to servers, steal device enrollment credentials, and move quickly through company networks.

After a rough week for security teams already facing major threats – including PHP flaws that could potentially impact 70% of the internet – the incident has ignited online debate over what responsible disclosure should look like.

What is Tailscale, and which businesses are at risk?

Tailscale is a VPN service that allows businesses securely connect employees' devices, servers and cloud systems over the internet. It is widely used by IT teams to provide remote access to company networks without exposing sensitive systems directly to the internet.

Notable customers include Microsoft, Nvidia, SAP, Duolingo, Instacart, Airbus and Mistral AI

The findings are especially important for organizations that use Tailscale SSH to manage servers, particularly if they have broad access permissions.

Businesses using experimental app connectors or self-hosted Headscale setups face additional risks, Windisch warns in a report that followed lab testing from 22nd to 24th October.

Windisch, whose company Cyberdione Labs claims to develop infrastructure for autonomous and self-improving AI agents, documented the vulnerabilities discovered during the 3 days of testing.

It remains unclear whether AI tools contributed to the discoveries.

In one lab test, a compromised device could gain privileged access to other permitted servers and enroll an attacker-controlled machine into the network.

The most serious SSH attacks require an existing foothold on an authorized device and suitable access permissions.

They do not allow an unauthentic internet attacker to take over arbitrary Tailscale-connected machines.

Why publish before the patches are ready?

Widisch defended publishing the findings before the patches were available, arguing that vulnerabilities in open-source infrastructure already expose users to risk and that independent researchers should not have to wait for a commercial vendor’s disclosure timetable.

It is the opinion of the researchers that rapid awareness of these flaws will expedite remediation across impacted devices,

says Erica Windisch, founder and security researcher at Cyberdione Labs.

“These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort,” she added.

Widisch told The Hacker News that the proof-of-concept exploit code had not been released publicly and had been shared only with Tailscale’s security contact.

The decision nevertheless attracted criticism, with one social media commenter demanding:

“Dude, can we please stop publishing vulns before they are disclosed to the vendor!?!”

Another X poster said: “If you can’t publish ethically and with responsible disclosure, you are not a researcher.”

Tailscale responds: Should admins disable SSH?

Responding to the report on Reddit, Tailscale Vice President of Engineering Mike Sheaver confirmed the company was investigating security issues and preparing fixes, but cautioned against overreacting.

“Based on our current assessment, we’re not recommending that everyone disable Tailscale SSH,” he said.

Instead, Tailscale advised customers to review SSH access and forwarding permissions, tighten access to sensitive systems, and enable automatic updates.

Acknowledging the PHP and Node.js incidents – among plenty of others – last week, Sheaver acknowleged:

We know it’s been a rough week for security teams, and we understand why people are concerned,

says Tailscale vice president of Engineering Mike Sheaver, responding on Reddit.

The findings come just months after Tailscale fixed a similar security flaw that could allow users with limited access to gain greater control over servers. The flaw, tracked as TS-2026-004, was fixed in version 1.98.9.