CVE-2026-55883
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in Tilt from version 0.24.0 to 0.37.3 allows an attacker to access the HUD view stream via WebSocket despite CSRF protection. The CSRF token is served by an unauthenticated endpoint, and the server accepts connections without an Origin header, enabling theft of session data, Tiltfile contents, and resource statuses.
Risk Assessment
The risk involves leakage of sensitive configuration data and application state, which could enable further attack escalation or infrastructure information disclosure.
Recommendation
Upgrade Tilt to version 0.37.4 or later immediately. If upgrading is not possible, restrict network access to the HUD interface to trusted IP addresses only.
Other vulnerabilities in Tilt
See all- CVE-2026-55884Critical
The Tilt HUD HTTP server in versions 0.20.8 through 0.37.3 registers handlers on a gorilla/mux router with no authenticating middleware. When bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources via the token-attaching /proxy handler.
- CVE-2026-55882High
Tilt HUD server mounts unauthorized pprof handlers under /debug, allowing an unauthenticated attacker to read process memory (including session and API tokens) and degrade performance. The vulnerability affects versions 0.19.5 through 0.37.3.
Original NVD description (English source)
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader accepts clients that omit an Origin header. When the HUD is network-exposed, an attacker who can reach the listener can open the HUD WebSocket and receive the full view stream, including session state, Tiltfile contents, resource statuses, and continued updates. This issue is fixed in version 0.37.4.