Deep Research: Tailworm and Tailscale

I asked for a public-sources read on Tailworm, the security report Erica Windisch published against Tailscale on 24 October, because a lot of people run small labs on Tailscale and the loudest posts were either panic or anger about disclosure.

The headline chain, root on another machine, starts inside Tailscale’s own SSH server. That feature is off unless someone turned it on. If you never ran tailscale set --ssh, the worst of this is not about you. The rest of the findings sit behind tailscale serve, Funnel or app connectors, all opt-in too.

Tailscale’s own code agrees with the report on the SSH class. Fixes for two findings are on main, the fix for the SSH forwarding findings is still open pull requests, and no release carries any of it yet.

Moving to Headscale doesn’t help. You keep the same client and lose Tailnet Lock. Plain WireGuard or Nebula only make sense if someone will own keys and NAT.

Full Deep Research: Tailworm and Tailscale: What a Homelab Owner Should Do