VULNERABILITY INTELLIGENCE
CVE-2026-55884
EPSS probability0.50%
CISA KEVNot currently listed
Published2026-07-10
Last modified2026-10-25
Description
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.
Weakness classification
- security-advisories@github.com: CWE-306