Tailscale Alternatives: Which Mesh VPN Fits Your Team in 2026?

What the October 2026 Tailscale SSH bulletins actually say

Tailscale is a WireGuard-based mesh VPN: a coordination server distributes node keys and ACL policy, while traffic flows peer-to-peer or through DERP relays. Tailscale SSH is the add-on that replaces OpenSSH on a tailnet by running an SSH server inside the root-privileged tailscaled daemon and checking access against the tailnet policy file.

On October 23, 2026, researchers and users began discussing SSH concerns on social media. Tailscale says it received the researcher's report, titled Tailworm, on the morning of October 24 and that the researcher published it two hours later. On October 26 the company shipped fixes in v1.104.4 and published four bulletins, TS-2026-014 through TS-2026-017.

The four findings, in Tailscale's own scoping:

• TS-2026-014: SSH Unix socket forwarding ran as root, so a peer with forwarding rights allowed by policy could reach sockets the session's local user could not, including the Docker socket and the tailscaled local API. Impact requires SSH enabled and local or remote forwarding permitted in your policy.
• TS-2026-015: unbounded memory growth in SSH session handling (window-change messages and environment appends), giving an authenticated peer a way to OOM-kill tailscaled. That drops every Tailscale connection on the node, not just the SSH session.
• TS-2026-016: tailscale serve dialed Unix backends as root, exposing the tailscaled local API. Tailscale describes the first issue as allowing full node takeover. It applies where a local operator can write serve configurations, or where local users can write to configured backend paths.
• TS-2026-017: with Serve TLS enabled and at least two mounts with different capability requirements, concurrent HTTP/2 streams could race on shared state and leak Tailscale-App-Capabilities between mounts, so an app might authorize a peer on another app's capability.

Two things matter for a buyer. First, none of this is unauthenticated remote exploitation: Tailscale states that an attacker needs an existing foothold on an authorized peer, with SSH explicitly permitted in the policy file. The Tailworm report does not describe self-replicating malware. Second, the credential side is separate: bulletin TS-2026-013 from October 21 covers eight compromised eMudhra TLS intermediates and pushed clients to v1.104.2 or later. Two update deadlines in one month is a reasonable moment to ask whether your access layer should depend on one vendor's release cadence.

Tailscale alternatives compared: verified pricing and limits

Every number below comes from the vendor's own pricing page, read on October 30, 2026. Currencies are as published, so NetBird is quoted in euros and the rest in dollars; do not read the table as a single-currency ranking.

One structural difference decides most of these comparisons. Tailscale and Twingate charge per user. ZeroTier charges per device, with a fixed monthly floor. NetBird charges per active user plus a small per-machine fee. Headscale has no bill at all because there is no vendor.

Two worked examples, using each vendor's published unit prices and nothing else. A 10-user team with 15 devices pays $80/month on Tailscale Standard, $28 on ZeroTier Essential (10 included devices plus five at $2.00), EUR60 on NetBird Team and $50 on Twingate Teams. A 25-user team with 40 devices pays $200 on Tailscale, $78 on ZeroTier (30 extra devices at $2.00), EUR150 on NetBird Team and $125 on Twingate Teams. ZeroTier wins both times, but only because its Essential tier was never designed around seat count, and the spreadsheet stops working the moment you need identity-aware SSH or SAML-backed policy.

Read those numbers as structure, not as a verdict. Per-startup budget math is the easy part. The part that decides your bill in year two is which tier you land on after the first growth spurt: ZeroTier Essential's 10-device floor and $2.00 overflow push a 60-device fleet to $118/month, still below Tailscale Standard at 15 users, and well below it at 25.

ZeroTier: per-device pricing wins when devices outnumber people

ZeroTier's Personal plan is free for 10 devices on one network, limited to non-commercial use. Essential is $18/month and includes a commercial license, 10 devices with $2.00 for each additional device, 10 networks, five admins, OIDC single sign-on, API access and 30-day audit logs. Scale is $179/month with 100 devices included at $1.80 each beyond that, unlimited networks, 10 network admins and ticketed support with an SLA. Enterprise is custom and adds self-hosted or air-gapped deployment with 90-day audit logs.

The arithmetic is the story. Six people running servers, laptops and a couple of routers sit comfortably under 10 devices, so they pay $18/month. The same six on Tailscale Standard pay $8 each, or $48/month. Push that team to 20 devices and ZeroTier Essential becomes $18 plus 10 extra devices at $2.00, so $38/month, still under Tailscale's $48.

What you give up is the polished SSH layer. ZeroTier manages connectivity and routes; it does not ship an identity-aware SSH server that replaces OpenSSH, so you keep your own bastion or SSH certificate setup. For a homelab or a small agency with mixed devices, that trade is fine. For a team that specifically chose Tailscale for SSH check mode and ACL-driven machine access, ZeroTier is a rebuild, not a swap.

NetBird: the closest drop-in, with a self-hosted control plane

NetBird is the alternative that maps most directly onto Tailscale's feature set. Its cloud pricing has a free tier at EUR0 per user/month for up to 5 users and 100 machines, with NetBird SSH, private DNS, network routes and access controls included. Team is EUR6 per user/month with unlimited users, 100 machines plus 10 per additional user, enterprise IdP single sign-on, SCIM provisioning and audit event logging. Business is EUR12 per user/month and adds device approvals, MDM and EDR device controls, posture checks, and audit and traffic event streaming. Enterprise is custom. Extra machines cost EUR0.50 per month.

Billing follows activity: NetBird charges only for users and machines that connected or logged in at least once during the billing period. That detail matters for contractors and CI runners that exist for a week and disappear. A 6-person team on Team lands at EUR36/month, or EUR72 on Business with posture checks, which is the honest comparison point against Tailscale Premium at $18/user for similar compliance features.

NetBird also ships a self-hosted edition, so the control plane can sit inside your own infrastructure. Its GitHub repository has 30,358 stars and reports a non-standard license on the API ("Other", not a recognized SPDX identifier), so read the license file before you plan to redistribute or rebrand it. Self-hosting moves the patch cadence problem rather than removing it.

Twingate: cheapest per seat, with real posture checks

Twingate prices by user, which makes it the cheapest paid seat in this comparison. Starter is free for up to 5 users with conditional access controls and split tunneling. Teams is $5 per user/month with a 15% discount for yearly billing, covering up to 100 users, SSO through Google Workspace, SaaS application gating, device posture checks and MFA for bastion hosts and SSH. Business is $10 per user/month for up to 500 users and adds Okta and Entra ID single sign-on, IdP-driven provisioning, usage-based and just-in-time access policies, exit networks and DNS filtering. Enterprise is custom. Home exists at $15/month for up to 7 users but is explicitly limited to non-commercial use, so it is not a business option.

Twingate's model is zero trust on both ends: a connector sits in front of each resource and the client connects to the connector, so nothing is exposed at the network layer. That is a different shape from a flat mesh. If your goal is "every laptop can reach every server on a private IP", Twingate will feel restrictive. If your goal is "this contractor reaches only the staging dashboard", it produces a tighter policy surface for less money than Tailscale Standard.

The migration cost is in the connectors. Each resource group needs a connector deployed, usually in a VPC or on a host, so plan a few days of work instead of an afternoon of key distribution.

Headscale: the free option that bills you in uptime

Headscale is an open-source implementation of a Tailscale control server. It is BSD-3-Clause licensed, has 45,193 GitHub stars, was created in June 2020 and was pushed to as recently as October 30, 2026. You run it, and stock Tailscale clients connect to it, which means you can keep the client-side SSH and MagicDNS behaviour you already know while removing the vendor from the path.

There is no license fee and no per-seat ceiling. There is also no support contract, no status page, and no one to page at 2am except yourself. Consider the real cost per month: a small VPS plus backups plus the engineer hours to patch it. If you are already running Postgres and Kubernetes, that is marginal. If you are a five-person shop without an on-call rotation, self-hosting your access control plane converts a vendor risk into an availability risk, and the availability risk is more likely to bite.

Headscale is the right answer for teams with a hard data-residency or air-gap requirement, and a poor answer for teams reacting to a security bulletin.

Who should switch, and who should just patch

Start with the update, not the migration. v1.104.4 fixes all four SSH bulletins, and Tailscale documents TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment as a mitigation that turns off forwarding without disabling SSH entirely. Rotating any long-lived keys and reviewing the SSH section of your policy file is a day of work that removes most of the exposure the bulletins describe.

Switch if one of these is true:

• Your team is small and device-heavy. ZeroTier Essential at $18/month for 10 devices undercuts per-seat pricing until you pass roughly 16 devices.
• You need the control plane in your own infrastructure. NetBird's self-hosted edition or Headscale gets you there without inventing a protocol.
• Per-seat cost dominates and you want resource-level policy. Twingate Teams at $5/user/month with connectors is cheaper than Tailscale Standard at $8 and gives finer default-deny behaviour.

Stay if you rely on Tailscale SSH as your primary machine access path, on tailnet-level ACL groups, or on the exit-node and subnet-router setup your infrastructure already assumes. Rebuilding that on ZeroTier or Twingate is a week of work per environment, and the vulnerabilities in question needed an attacker already inside your tailnet. A compromised laptop matters more than a forwarding bug.

If you do migrate, the checklist is consistent across all four: map every ACL group to the equivalent construct, confirm which hosts will need connectors or subnet routes, re-plan DNS (MagicDNS has no direct equivalent in ZeroTier), decide whether SSH moves to a bastion or stays identity-aware, and test key rotation before you cut over.

At a glance

Tailscale alternatives pricing, verified on vendor pages October 30, 2026

FAQ

Is Tailscale still free for personal use?

Yes. Tailscale's Personal plan is $0 and covers up to 6 users, unlimited user devices, 3 ACL groups and 50 tagged resources, with 1,000 minutes per month of ephemeral resources, per the pricing page checked on October 30, 2026.

Is ZeroTier cheaper than Tailscale for a small team?

Usually yes if devices outnumber users. ZeroTier Essential is a flat $18/month for 10 devices, while Tailscale Standard charges $8 per user, so six users cost $48/month. Past roughly 16 devices the per-device fees close the gap.

Can I run a Tailscale-compatible control server myself?

Headscale is a self-hosted control server for Tailscale clients, BSD-3-Clause licensed with 45,193 GitHub stars as of October 30, 2026. It removes the vendor bill but makes you responsible for availability, upgrades and key rotation.

Related reading

Tailscale pricing and plan limits, ToolBistro radar index

Sources

• Tailscale SSH: Findings and fixes
• Tailscale security bulletins (TS-2026-013 to TS-2026-017)
• Tailscale pricing
• ZeroTier pricing
• NetBird pricing
• Twingate pricing
• Headscale repository