SECURITY ASSESSMENT REPORT — TAILSCALE V1.104.2 AND HEADSCALE V0.29.5

Summary from the TLDR InfoSec newsletter

Researchers report verified flaws in Tailscale v1.104.2 and headscale v0.29.5. Tailscale SSH Unix-socket forwarding runs as root, enabling privilege escalation, socket replacement, root-file deletion, enrollment-key theft, and rogue node enrollment. The experimental conn25 connector lets an entitled user reach cloud metadata, internal LANs, and Kubernetes services without destination validation. Headscale has unauthenticated memory-exhaustion and onboarding-lockout issues. Recommended controls include per-pair SSH grants, forwarding disabled, connector egress allowlists, hardware-bound credentials, and control-plane node deletion during incident response.