CVE-2026-55884criticalCWE-306

CVE-2026-55884: critical vulnerability in tilt-dev tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server

Published · Updated

Follow this CVE+ Monitor tilt+ Monitor github.com/tilt-dev/tilt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.5%
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
tilt-dev · tilt
Related CVEs — tilt-dev tilt

In the same product, most dangerous first.

CVE-2026-55882HIGHTilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverEPSS 0.5%CVE-2026-55883HIGHTilt: Cross-site WebSocket hijacking of the Tilt HUD streamEPSS 0.3%