Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: TailscaleHound is an OpenGraph collector for BloodHound that maps Tailscale users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, services, keys, invites, webhooks, and hybrid Azure identity relationships. The result is a graph that helps answer practical questions like, “Which users can reach this device?”, “Who can use this exit node?”, “Which routes are exposed through subnet routers?”, and “Which Azure users inherit Tailscale access?”
Take me to the repo.
Introduction
In Leveraging Tailscale Keys, Andrew Luke covered the Tailscale concepts and red team tradecraft that matter when authentication keys show up during an assessment. That post is the right place to start if you want a primer on tailnets, nodes, subnet routers, exit nodes, and why Tailscale access can matter so much during an operation.
This blog picks up where Andrew Luke left off.
Once Tailscale exists in an environment, the next problem is visibility. Tailscale access is not just a “VPN” but, rather, a set of identity, device, group, tag, route, SSH, posture, and policy relationships. A user may not have direct access to a sensitive host, but they may be in a group that has access to a tag. A tagged device may advertise routes to internal network spaces. An exit node may provide traffic egress from a privileged location. A Tailscale user may also line up cleanly with an Azure user that already exists in BloodHound. These can quickly turn into identity problems during an incident.
TailscaleHound turns Tailscale into OpenGraph data so those relationships can be queried …