Read the docs
TI-2026-40337 Aliases CVE-2026-55884GHSA-c73q-8xxr-rgqm

Tilt: Missing authentication on the network-exposed Tilt HUD server

Priority MEDIUM 48CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00496 42nd percentileScored 2026-11-07
Fix Fixed tilt (tilt-dev): 0.37.4github.com/tilt-dev/tilt (Go): 0.37.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tilt-devtilt0.20.8 to before 0.37.40.37.4Patch availableCNA
—github.com/tilt-dev/tilt (Go)0.20.8 to before 0.37.40.37.4Patch availableGHSA-c73q-8xxr-rgqm
  • tilt Vendortilt-dev Affected 0.20.8 to before 0.37.4 Fixed in 0.37.4 Patch available CNA
  • github.com/tilt-dev/tilt (Go) Vendor— Affected 0.20.8 to before 0.37.4 Fixed in 0.37.4 Patch available GHSA-c73q-8xxr-rgqm

Remediation

  • Fix · CNA tilt (tilt-dev) Fixed in 0.37.4
  • Fix · GHSA-c73q-8xxr-rgqm github.com/tilt-dev/tilt (Go) Fixed in 0.37.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55884
  2. 2026-10-03 Alias added: GHSA-c73q-8xxr-rgqm

References

Other 5

  • TI-2026-40335 Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server CVSS 4.0HIGH 8.3
  • TI-2026-40336 Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences