Nice2GeekYou

Use Tailscale for Remote Access? Update to 1.104.4 After the "Tailworm" SSH Flaws

Tailscale shipped version 1.104.4 on October 27-28, 2026 to fix SSH and Serve flaws from the "Tailworm" report that could let an already-compromised device gain root-level access on other servers. Here's what a small business using Tailscale should do this week.

  • tailscale
  • vpn
  • remote-access
  • ssh
  • patching
  • network-security
  • zero-trust
  • smb
  • managed-it

If your business uses Tailscale to reach office PCs, servers or cameras remotely, update every device to version 1.104.4 or later this week. Tailscale released the fix after a researcher published a report called "Tailworm" over the weekend, describing flaws in Tailscale SSH and in the Serve and Funnel features. Tailscale confirmed the problems in a blog post on October 28, 2026 and published four security bulletins (TS-2026-014 through TS-2026-017).

Why it matters

Tailscale is a popular way for small offices and IT providers to connect laptops, servers and network gear without opening ports on the firewall. The new flaws don't let a stranger on the internet break in. An attacker first needs control of a device your Tailscale policy already trusts. But once they have that foothold, a permitted SSH session could reach things only the root (administrator) account should touch, such as the Docker control socket, which can mean full control of that server. Another bug could let a session use up a server's memory and crash Tailscale, cutting remote access to that machine.

In plain terms: one hacked laptop on your Tailscale network could become a stepping stone to your servers. That's exactly the kind of lateral movement ransomware crews look for.

What to do this week

  1. Update every Tailscale device to 1.104.4 or newer. That includes Windows and Mac laptops, Linux servers, NAS boxes and any always-on "subnet router" machine. Turn on Tailscale's auto-update where it's offered.
  2. Can't update a Linux server yet? Tailscale says setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service turns off SSH forwarding and blocks several of the more serious findings.
  3. Tighten who can SSH where. Review your Tailscale access policy so only the people and devices that truly need SSH have it, one pair at a time, rather than broad "everyone to everything" rules.
  4. Use SSH check mode on sensitive systems. It makes users sign in again before a session starts. It won't stop these specific bugs, but it raises the bar for a stolen device.
  5. Remove devices you don't recognize. Delete old or unknown machines from the Tailscale admin console. A stolen device key stays valid until the device is removed there, even if the computer is wiped.

Nice2GeekYou is based in San Antonio, serving all of Texas on site, and our managed IT plans cover remote clients across the U.S. We keep remote-access tools like Tailscale, Splashtop and VPNs patched and locked down as part of every plan. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Tailscale — Tailscale SSH: Findings and fixes (Oct 28, 2026); Tailscale Security Bulletins; The Hacker News — Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers (Oct 28, 2026).