Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55884: Tilt HUD Server Exposes Sensitive Information to Network Attackers

CVE-2026-55884 · published 3 months ago

Summary

A security issue in the Tilt HUD server allows network attackers to access sensitive information and control the Tilt environment. This is because the server does not require authentication when exposed to the network. To fix this, you should ensure that the HUD server is only accessible from the local machine and not from the network.

What to do

Update github.com tilt-dev to version 0.37.4.
Update tilt-dev github.com/tilt-dev/tilt to version 0.37.4.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	tilt-dev	>= 0.20.8, <= 0.37.3 Fix: upgrade to 0.37.4
Go	tilt-dev	github.com/tilt-dev/tilt	>= 0.20.8, < 0.37.4 Fix: upgrade to 0.37.4
–	tilt-dev	tilt	>= 0.20.8, < 0.37.4

Original advisory text

Tilt: Missing authentication on the network-exposed Tilt HUD server

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.

References

https://github.com/tilt-dev/tilt/releases/tag/v0.37.4 URL
https://github.com/advisories/GHSA-c73q-8xxr-rgqm
https://github.com/tilt-dev/tilt Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55884... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-55884 Vendor Advisory
https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a Patch
https://github.com/tilt-dev/tilt/pull/6776 Patch
https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published10 Jul 2026

Updated4 Nov 2026

First seen19 Jun 2026

Sources

GHSA-c73q-8xxr-rgqm · GHSA

CVE-2026-55884 · NVD

GHSA-c73q-8xxr-rgqm · OSV

CVE-2026-55884 · MITRE

CVE-2026-55884 · OSV

Track software like this

Free during beta