CVE-2026-55883

Received Received - Intake

Tilt HUD WebSocket Session Exposure via CSRF Bypass

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader accepts clients that omit an Origin header. When the HUD is network-exposed, an attacker who can reach the listener can open the HUD WebSocket and receive the full view stream, including session state, Tiltfile contents, resource statuses, and continued updates. This issue is fixed in version 0.37.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-55883

Affected Vendors & Products

Vendor	Product	Version / Range
tilt	tilt	From 0.24.0 (inc) to 0.37.3 (inc)
tilt	tilt	0.37.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Tilt versions from 0.24.0 through 0.37.3, where the Tilt HUD WebSocket at /ws/view is protected by a CSRF token. However, the token is served by an unauthenticated endpoint (/api/websocket_token), and the WebSocket upgrader accepts clients that omit the Origin header.

Because of this, if the HUD is exposed on the network, an attacker who can reach the listener can open the HUD WebSocket without proper authentication and receive the full view stream. This stream includes sensitive information such as session state, Tiltfile contents, resource statuses, and ongoing updates.

This issue was fixed in version 0.37.4.

Impact Analysis

If you are running a vulnerable version of Tilt with the HUD WebSocket network-exposed, an attacker could connect to the WebSocket and access sensitive information including session state, configuration files (Tiltfile contents), resource statuses, and live updates.

This could lead to unauthorized disclosure of internal development environment details, potentially aiding further attacks or exposing confidential information.

Mitigation Strategies

The vulnerability is fixed in Tilt version 0.37.4. The immediate step to mitigate this vulnerability is to upgrade your Tilt installation to version 0.37.4 or later.

Additionally, avoid exposing the Tilt HUD WebSocket listener to untrusted networks to reduce the risk of unauthorized access.

Hi! I’m here to help you understand CVE-2026-55883. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70