CVE-2026-55882
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Tilt HUD server mounts unauthorized pprof handlers under /debug, allowing an unauthenticated attacker to read process memory (including session and API tokens) and degrade performance. The vulnerability affects versions 0.19.5 through 0.37.3.
Risk Assessment
Risk includes leakage of sensitive credentials (session and API tokens) and potential performance degradation, which could lead to unauthorized access to the Kubernetes cluster and service disruption.
Recommendation
Upgrade Tilt to version 0.37.4 or later immediately. If upgrading is not possible, restrict network access to the HUD and apiserver listener to trusted networks only.
Other vulnerabilities in Tilt
See all- CVE-2026-55884Critical
The Tilt HUD HTTP server in versions 0.20.8 through 0.37.3 registers handlers on a gorilla/mux router with no authenticating middleware. When bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources via the token-attaching /proxy handler.
- CVE-2026-55883High
A vulnerability in Tilt from version 0.24.0 to 0.37.3 allows an attacker to access the HUD view stream via WebSocket despite CSRF protection. The CSRF token is served by an unauthenticated endpoint, and the server accepts connections without an Origin header, enabling theft of session data, Tiltfile contents, and resource statuses.
Original NVD description (English source)
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.