CVE-2026-55884criticalCWE-306

CVE-2026-55884: falha crítica em tilt-dev tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tilt+ Monitorar github.com/tilt-dev/tilt

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.5%
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
tilt-dev · tilt
CVEs relacionadas — tilt-dev tilt

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55882HIGHTilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverEPSS 0.5%CVE-2026-55883HIGHTilt: Cross-site WebSocket hijacking of the Tilt HUD streamEPSS 0.3%