Tailworm: what the Tailscale research does and does not show

What dates and evidence are involved?

Erica Windisch’s Tailworm report describes laboratory testing on 22–24 October using Tailscale 1.104.2 and headscale 0.29.5. This article’s event date marks the end of that testing window, not a verified first-publication date.

The report covers distinct components, including Tailscale SSH forwarding, experimental app connectors and headscale resource exhaustion. Findings in one component cannot be applied to every deployment. The SSH findings require an already permitted connection and relevant access policy.

What has the vendor said?

In a public response, Tailscale engineering lead Mike Shaver said the company was investigating, working on fixes and determining affected configurations. He said the company was not recommending that everyone disable Tailscale SSH.

That is an initial vendor response, not confirmation that all findings are fixed. The response used here was available as an indexed search excerpt; direct access to the complete discussion was blocked.

What should your administrator review?

Ask which affected features are enabled, which devices and users may establish SSH connections, and which permissions are genuinely required. Plan changes so that necessary administrative access remains available.

The certificate update in Tailscale 1.104.2 is not a Tailworm fix. This source check has not established a release fixing the entire report. OEJ has not reproduced the laboratory experiments or tested any customer network.