Tilt vulnerabilities
3 known CVE vulnerabilities in Tilt, translated and rated.
- CVE-2026-55884Critical
The Tilt HUD HTTP server in versions 0.20.8 through 0.37.3 registers handlers on a gorilla/mux router with no authenticating middleware. When bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources via the token-attaching /proxy handler.
- CVE-2026-55883High
A vulnerability in Tilt from version 0.24.0 to 0.37.3 allows an attacker to access the HUD view stream via WebSocket despite CSRF protection. The CSRF token is served by an unauthenticated endpoint, and the server accepts connections without an Origin header, enabling theft of session data, Tiltfile contents, and resource statuses.
- CVE-2026-55882High
Tilt HUD server mounts unauthorized pprof handlers under /debug, allowing an unauthenticated attacker to read process memory (including session and API tokens) and degrade performance. The vulnerability affects versions 0.19.5 through 0.37.3.