# What Is Tailscale? How It Works, Setup & the October 2026 Tailscale SSH Report

> What is Tailscale? Learn how it works, set it up on Ubuntu, use it with your xCloud server, and what the October 2026 Tailscale SSH report means for you.

**What is Tailscale?** It is the tool that answers a question every growing team hits: how do I reach my servers, databases and internal dashboards from anywhere, without opening them to the whole internet? The old answer was a VPN server you had to run, patch and babysit. Tailscale turns your laptop, servers and teammates' devices into one private network in a few minutes.

It is also in the news. On **October 25, 2026**, a researcher published a report called **"Tailworm"** describing unpatched flaws in **Tailscale SSH**. If you run Tailscale, that headline deserves a calm, practical read rather than panic. If you also publish apps through Cloudflare, our guide to [**Cloudflare Tunnel**](/what-is-cloudflare-tunnel/) covers the other half of private access.

This guide explains what Tailscale is, how it works, what it costs, how to set it up on Ubuntu, how xCloud users can use it safely, and exactly what the Tailscale SSH report means for you.

![What is Tailscale: a laptop, app server, database and teammate in one private network](/_landing/blog/what-is-tailscale-cover.jpg)

## TL;DR (Too Long, Didn't Read?)

Short on time? Here is the whole guide in a few lines:

- **Tailscale** builds a private network (a **tailnet**) between your devices, using **WireGuard** encryption.
- Every device gets a stable private address in the `100.x.y.z` range and a name through **MagicDNS**.
- You do not run a VPN server or open inbound ports. Devices connect directly when they can and through **relays** when they cannot.
- **Free for personal use** (up to 6 users). Business plans start at $8 per user per month.
- **Tailworm report:** the serious findings concern the **Tailscale SSH** feature, not the network itself. Narrow your SSH rules, turn off port forwarding where you can, and keep updates on.
- **Update now:** Tailscale bulletin **TS-2026-013** recommends **1.104.2 or later** for the eMudhra certificate issue.

## What Is Tailscale?

**Tailscale is a mesh VPN that connects your devices into one private, encrypted network, without a central VPN server in the middle of your traffic.** You install a small client on each device, sign in, and the devices can reach each other by private IP or by name, wherever they are.

Think of it like an office building with a private internal phone system. Every desk gets an extension number that works from anywhere: home, a café, another country. Outsiders cannot dial those extensions at all, and you decide which desks are allowed to call which.

### A Few Things Worth Knowing

- **It is built on WireGuard**, the modern VPN protocol. Tailscale manages the keys and configuration you would otherwise write by hand.
- **Traffic goes device to device.** Tailscale's servers coordinate keys and access rules, but your data travels directly between your devices whenever possible.
- **Access is deny-by-default if you want it to be.** A policy file (ACLs or grants) decides which users and devices can reach which ports.
- **It is not just for laptops.** Servers, containers, routers, phones and CI runners can all join.

| Term | What it means |
|---|---|
| **Tailnet** | Your private Tailscale network: all the devices and users that belong to it |
| **Tailscale IP** | A stable private address for each device, in the `100.64.0.0/10` range |
| **MagicDNS** | Automatic names for devices, so you type `db-1` instead of an IP |
| **ACLs / grants** | The access policy that says who can reach what |
| **DERP relay** | Tailscale's encrypted relay used when two devices cannot connect directly |
| **Exit node** | A device that routes all your internet traffic, like a classic VPN |
| **Subnet router** | A device that gives the tailnet access to a whole private network behind it |
| **Tailscale SSH** | Optional built-in SSH that uses tailnet identity instead of SSH keys |
| **Funnel** | Optional feature that publishes a service from your tailnet to the public internet |

## How Does Tailscale Work?

Here is the part that makes Tailscale feel like magic: **there is no VPN server sitting in the path of your traffic.**

1. **You sign in.** Each device authenticates with your identity provider (Google, Microsoft, GitHub and others) and generates its own WireGuard key pair.
2. **The coordination server shares public keys.** Tailscale's control plane tells each device the public keys and addresses of the peers it is allowed to reach, based on your access policy.
3. **Devices punch through NAT.** Using NAT traversal, two devices behind home routers or cloud firewalls find a direct path to each other.
4. **Relays fill the gaps.** If no direct path exists, traffic goes through a **DERP relay**. It is still end-to-end encrypted, so the relay cannot read it.
5. **Policies decide everything.** Even inside the tailnet, a device can only reach the ports your ACLs allow.

The trade-off is that **you trust Tailscale's coordination service** to hand out keys correctly. For teams that cannot accept that, **Headscale** is an open-source, self-hosted control server, at the cost of running it yourself.

### Is Tailscale Free?

Yes, for personal use. According to [**Tailscale's pricing page**](https://tailscale.com/pricing), the **Personal** plan is free indefinitely for **up to 6 users** with **unlimited user devices**, basic Tailscale SSH on up to five hosts, and nearly all features. It is meant for **non-commercial use**.

For business, **Standard** costs **$8 per user per month** and **Premium $18 per user per month**, with custom Enterprise pricing above that.

## Tailscale vs WireGuard vs Cloudflare Tunnel

These three come up together all the time. They solve related but different problems.

| | **Tailscale** | **Plain WireGuard** | **Cloudflare Tunnel** |
|---|---|---|---|
| **Main job** | Private network between your devices | Encrypted link you configure yourself | Publish an app through Cloudflare without open ports |
| **Who connects** | Your devices and teammates | Peers you configure by hand | Anyone you allow, in a normal browser |
| **Setup** | Install and sign in | Key exchange and config files per peer | Install `cloudflared` and add a hostname |
| **NAT traversal** | ✅ Automatic | ❌ You handle it | ✅ Outbound connection only |
| **Access control** | ACLs and grants | Firewall rules | Cloudflare Access |
| **Best for** | SSH, databases, admin tools, server-to-server | Fixed site-to-site links | Websites and tools for people outside your team |

**Rule of thumb:** Tailscale for **people and machines you trust**, Cloudflare Tunnel for **things the outside world should reach**. Many teams run both: dashboards and SSH on the tailnet, public webhooks through a tunnel.

## How to Set Up Tailscale on Ubuntu

You need an Ubuntu server with a **sudo user** and a free Tailscale account. On xCloud, see [**sudo users and site users**](/docs/usudo-users-and-site-users-in-xcloud/) and connect with [**SSH keys**](/docs/how-to-generate-and-add-ssh-keys-in-xcloud/).

### Step 1: Install Tailscale

Tailscale's install script detects your distribution and adds its official package repository:

```bash
curl -fsSL https://tailscale.com/install.sh | sh
tailscale version
```

The version should be **1.104.2 or newer**.

### Step 2: Join the Server to Your Tailnet

```bash
sudo tailscale up
```

The command prints a login link. Open it, sign in, and approve the device. For servers you add often, create an **auth key** in the admin console instead, and prefer **tagged, one-time keys**, so a leaked key cannot add more devices.

### Step 3: Turn On Automatic Updates

Security fixes only help if they arrive. Turn on Tailscale's own updater:

```bash
sudo tailscale set --auto-update
```

### Step 4: Find Your Tailscale IP and Test

```bash
tailscale ip -4
tailscale status
```

From your laptop (also on the tailnet), `ping` the server's `100.x` address or its MagicDNS name.

### Step 5: Lock Down Access With ACLs

In the admin console, open **Access controls** and replace any "everyone can reach everything" default with specific rules: your team can reach SSH on servers, the app server can reach the database port, and nothing else. This is the step most people skip, and the one that matters most after this week's news.

👉 Tailscale's own guide: [**Tailscale quickstart**](https://tailscale.com/docs/how-to/quickstart).

## October 2026: The "Tailworm" Report on Tailscale SSH

This is where things get serious, so let us be precise. On **October 25, 2026**, Erica Windisch of Cyberdione Labs published **"Tailworm"**, a lab assessment of Tailscale 1.104.2 and Headscale 0.29.5 with 11 findings. [**The Hacker News**](https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html) covered the most serious ones, which concern **Tailscale SSH**.

### What the Report Says

- **Root through socket forwarding.** With Tailscale SSH port forwarding allowed, the report says a user could make the root-level Tailscale process connect to root-only sockets and gain root on the target.
- **Enrollment key theft.** A race condition could expose a device enrollment key, letting an attacker join their own machine to the tailnet. The report says this only worked end to end on tailnets **without Tailnet Lock**.
- **"Wormable" spread.** The report argues that one compromised device could reach every device the access rules allow. Some researchers dispute that label.

### What It Does Not Say

- **The attacker needs a foothold first.** Every scenario starts with one device already compromised (a vulnerable web app, a poisoned package, stolen logins) that your ACLs allow to SSH into others.
- **It is about the Tailscale SSH feature**, not the WireGuard network. Normal OpenSSH over a tailnet is a different code path.
- **There is no patch or CVE yet.** At the time of writing, there is no Tailscale security bulletin for these findings. The proof-of-concept is not public, and no one else has publicly reproduced the claims.
- **The disclosure is disputed.** The researcher says she sent the report and proof-of-concept before publishing. Critics say there was no coordinated disclosure window.

According to The Hacker News, Tailscale said it is working on fixes, is still determining which setups are affected, and is **not recommending that everyone disable Tailscale SSH**.

### Are You Affected?

| Your setup | Risk from this report | What to do |
|---|---|---|
| You do not use Tailscale SSH | Low: the SSH findings do not apply | Keep updates on, review ACLs |
| Tailscale SSH on, narrow rules, no port forwarding | Lower | Keep it narrow, enable check mode, watch for a bulletin |
| Tailscale SSH on, broad tag rules, port forwarding allowed | **Highest** | Narrow rules today, disable forwarding, consider OpenSSH instead |
| Self-hosted Headscale 0.29.5 | **High**: per the report, forwarding cannot be turned off there | Treat every SSH grant as root access |

### What to Do This Week

1. **Narrow your SSH rules.** Write one source-to-destination rule per real need. Remove broad rules such as "all members can SSH to all tagged servers".
2. **Turn off SSH port forwarding** wherever nobody needs it.
3. **Consider plain OpenSSH over the tailnet** for servers where Tailscale SSH is a convenience, not a requirement.
4. **Enable Tailnet Lock and key expiry**, so a stolen enrollment key cannot quietly add a device.
5. **Turn on SSH check mode** for sensitive hosts. It adds a login step. It does not fix the escalation, but it raises the bar.
6. **Remove a compromised device in the admin console**, not just by reinstalling it, because copied keys stay valid until revoked.
7. **Keep automatic updates on** so the fix lands the day it ships.

### Separately: Update for the eMudhra Certificates

Unrelated to Tailworm, Tailscale bulletin **TS-2026-013** (October 21, 2026) recommends **Tailscale 1.104.2 or later**. That release is built with Go 1.27.3, which distrusts the eight compromised eMudhra intermediate certificates, the same issue that required a [**cloudflared update**](/what-is-cloudflare-tunnel/) this month. Check the current list on [**Tailscale's security bulletins**](https://tailscale.com/security-bulletins).

## How xCloud Users Can Use Tailscale

The honest take first: **xCloud does not have a built-in Tailscale integration today, and your websites do not need one.** Visitors still reach your sites on ports 80 and 443 as usual. Tailscale earns its place for everything **behind** your sites: databases, SSH and internal tools.

Since Tailscale only makes outbound connections, installing it does not require opening a new inbound port in [**Firewall Management**](/docs/how-to-configure-firewall-management-in-xcloud/).

### 1. Private Database Access Without a Public Port

Need to connect a desktop SQL client or another server to MySQL? Instead of opening port 3306 to the internet, add a firewall rule that allows **3306 only from `100.64.0.0/10`**, the Tailscale address range. If MySQL only listens on `127.0.0.1`, set its bind address to the server's Tailscale IP first. Your database then answers only on the tailnet. See [**configuring MySQL and MariaDB with xCloud**](/docs/configure-mysql-and-mariadb-with-xcloud/) for the database side, and use an [**external database**](/docs/how-to-add-external-database-on-xcloud/) setup when your app and database live on different servers.

### 2. Team SSH Without Chasing IP Addresses

xCloud's [**SSH Lockdown**](/docs/how-to-configure-ssh-lockdown/) limits port 22 to xCloud's infrastructure and IPs you approve. Add a firewall rule that allows SSH from the Tailscale range `100.64.0.0/10`, and every teammate on the tailnet can SSH in from anywhere, while the public internet still cannot.

Given this week's report, **use normal OpenSSH over the tailnet** here rather than Tailscale SSH. Your existing [**SSH keys**](/docs/how-to-generate-and-add-ssh-keys-in-xcloud/) keep working, and **never remove xCloud's own IPs** from the lockdown, or the dashboard loses access to your server.

### 3. Private Dashboards and AI Agents

Running an admin UI, an uptime monitor or an AI agent dashboard on a [**plain server**](/docs/create-a-plain-server-with-xcloud/)? Bind it to the server's Tailscale IP, or allow its port only from `100.64.0.0/10`, and it never appears on the public internet. Our [**OpenClaw security best practices**](/openclaw-security-best-practices/) apply the same idea to agents.

### 4. Server-to-Server Across Providers

An app server on one cloud and a database or worker on another can talk over the tailnet as if they shared a private network, encrypted the whole way. No public database port, no provider-specific VPC.

### 5. Keep the Rest of the Server Patched

xCloud's [**automated security updates**](/docs/how-automated-security-updates-and-auto-reboot-work-in-xcloud/) keep Ubuntu's own packages current. Tailscale comes from its own repository, so turn on `tailscale set --auto-update` as in Step 3, and it updates itself.

## Common Tailscale Problems and Fixes

| Symptom | Likely cause | Fix |
|---|---|---|
| Device shows **offline** | `tailscaled` stopped or key expired | `sudo systemctl status tailscaled`, then `sudo tailscale up` |
| Connection works but is slow | Traffic going through a DERP relay | Run `tailscale status` and `tailscale netcheck`; allow outbound UDP |
| Can ping but not reach a port | ACL or server firewall blocks it | Check the ACL rule and allow the port from `100.64.0.0/10` |
| SSH works for one person, not another | ACL grants differ | Compare users in the access policy |
| Version below 1.104.2 | Auto-update off | `sudo tailscale set --auto-update` or upgrade with apt |

## Quick Checklist

- [ ] Every device on **1.104.2 or later**, with auto-update on
- [ ] ACLs replace any allow-all default
- [ ] Tailscale SSH rules narrowed, port forwarding off where unused
- [ ] Tailnet Lock and key expiry enabled
- [ ] Database and admin ports allowed only from `100.64.0.0/10`
- [ ] xCloud's SSH IPs still allowed on every server

## Make Your Private Network Boring Again

Tailscale is one of the simplest ways to give your team private access to servers, databases and tools without running a VPN server. The Tailworm report is a reminder that convenience features deserve the same care as anything else with root access, not a reason to tear it out.

This week, check every device is on **1.104.2 or newer**, narrow your Tailscale SSH rules, and move database and admin ports onto the tailnet. Then watch [**Tailscale's security bulletins**](https://tailscale.com/security-bulletins) for the fix.

**For the servers themselves, let the platform carry the load.** [**xCloud Managed Hosting**](/managed-hosting/) handles firewall rules, SSL and security updates for your sites, so your time goes into the work, not into the occasional 3 a.m. patch. Prefer your own VPS? [**Self-managed hosting**](/self-managed-hosting/) gives you the same dashboard on any provider.

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## Frequently Asked Questions

### Is Tailscale free?

Yes, for personal use. The free Personal plan covers up to 6 users with unlimited user devices and is meant for non-commercial use. Business use starts on the paid Standard plan at $8 per user per month.

### Is Tailscale safe after the Tailworm report?

Tailscale's core network is not what the report attacks. The serious findings concern the built-in Tailscale SSH feature with port forwarding allowed, and they need an attacker who already controls one device on your tailnet. Until Tailscale ships fixes, keep SSH rules narrow, turn off port forwarding where you can, and keep automatic updates on.

### Should I turn off Tailscale SSH?

Tailscale is not recommending that everyone disable it. If you do not need it, the simplest choice is to run normal OpenSSH over the tailnet instead, which the report's SSH findings do not cover. If you keep it, write one source-to-destination rule per need and remove broad tag grants.

### What is the difference between Tailscale and WireGuard?

WireGuard is the encryption protocol. Tailscale is a product built on top of it that handles keys, NAT traversal, access rules and DNS for you, so you never edit WireGuard config files by hand.

### Can I use Tailscale on my xCloud server?

Yes. Install it over SSH like on any Ubuntu server, keep the xCloud SSH rules in place, and use the tailnet for private database access, team SSH and internal tools. Your sites keep serving visitors on ports 80 and 443 as usual.

### Do I need to update Tailscale for the eMudhra certificate issue?

Yes. Tailscale bulletin TS-2026-013 recommends version 1.104.2 or later, because that release is built with Go 1.27.3, which distrusts the compromised eMudhra certificates. Run tailscale version to check.