CVE-2026-55884
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Tilt HUD HTTP server in versions 0.20.8 through 0.37.3 registers handlers on a gorilla/mux router with no authenticating middleware. When bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources via the token-attaching /proxy handler.
Risk Assessment
The organization is exposed to unauthorized access to Kubernetes development environments, potentially leading to session token leakage, configuration tampering, and execution of unwanted resources, compromising application integrity and confidentiality.
Recommendation
Immediately upgrade Tilt to version 0.37.4 or later. If upgrading is not possible, configure the HUD to listen only on the loopback interface (127.0.0.1).
Original NVD description (English source)
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.