---
title: "Deep Research: Tailworm and Tailscale"
created: 2026-10-25
visibility: public
status: live
type: research-summary
tags: [deep-research, security, tailscale, homelab]
summary: "Outside research on the Tailworm report against Tailscale. The serious findings need a feature you have to switch on. Leave Tailscale SSH, serve and Funnel off, gate new devices, and don't move to Headscale to escape it."
---

I asked for a public-sources read on Tailworm, the security report Erica Windisch published against Tailscale on 24 October, because a lot of people run small labs on Tailscale and the loudest posts were either panic or anger about disclosure.

The headline chain, root on another machine, starts inside Tailscale's own SSH server. That feature is off unless someone turned it on. If you never ran `tailscale set --ssh`, the worst of this is not about you. The rest of the findings sit behind `tailscale serve`, Funnel or app connectors, all opt-in too.

Tailscale's own code agrees with the report on the SSH class. Fixes for two findings are on `main`, the fix for the SSH forwarding findings is still open pull requests, and no release carries any of it yet.

Moving to Headscale doesn't help. You keep the same client and lose Tailnet Lock. Plain WireGuard or Nebula only make sense if someone will own keys and NAT.

Full Deep Research:
[[Tailworm and Tailscale: What a Homelab Owner Should Do]]