Tailworm

Tailworm is a research outlet that publishes security assessment reports on networking and identity software. This page presents a full report on Tailscale v1.104.2 and headscale v0.29.5, structured for both business readers and technical reviewers, with an executive summary followed by verified reproductions.

The report documents eight findings, each with a severity rating. These include Unix-socket forwarding that dials as root, remote forwarding that replaces root-owned sockets, TOCTOU races that defeat path allowlists, and a conn25 entitlement flaw that grants unrestricted egress selection through a connector. A headscale section covers memory exhaustion and an upstream client bomb.

Background sections explain the authentication model behind the first three findings and the reconnaissance available to an attacker, so the issues can be understood in context. Socket-target variations and guard-bypass notes add practical detail for those reproducing the work.

It is aimed at security researchers, network and platform engineers, and self-hosters running Tailscale or headscale who need to assess exposure and prioritize patching. Readers without familiarity with overlay networking will find the material dense.

Use it as a reference during audits: match findings to your deployed versions, check whether affected features such as app connectors or serve are in use, and treat severity ratings as a triage guide rather than a substitute for your own testing.