CVE-2026-55884

Received Received - Intake

Unauthenticated Access in Tilt HUD HTTP Server

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-55884

Affected Vendors & Products

Vendor	Product	Version / Range
tilt	tilt	From 0.20.8 (inc) to 0.37.3 (inc)
tilt	tilt	0.37.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Mitigation Strategies

The vulnerability is fixed in Tilt version 0.37.4. Immediate mitigation involves upgrading Tilt to version 0.37.4 or later.

Additionally, ensure that the Tilt HUD HTTP server is not bound to a non-loopback address to prevent unauthenticated network callers from accessing sensitive handlers.

Executive Summary

This vulnerability exists in Tilt versions 0.20.8 through 0.37.3, where the Tilt HUD HTTP server registers handlers on a gorilla/mux router without any authenticating middleware.

When the HUD is bound to a non-loopback address, an unauthenticated network attacker can exploit this to trigger developer-defined resources, tamper with Tiltfile arguments, read the full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler.

This means that unauthorized users can gain access to sensitive internal functions and data without any authentication.

Impact Analysis

The vulnerability allows unauthenticated attackers to perform several harmful actions remotely.

Trigger developer-defined resources, potentially causing unintended operations.
Tamper with Tiltfile arguments, which could alter the behavior of development environments.
Read the full engine state including session tokens, exposing sensitive information.
Invoke Kubernetes apiserver resources through the /proxy handler using the stolen session token, potentially leading to further compromise.

Overall, this can lead to unauthorized access, data exposure, and control over development environments.

Compliance Impact

This vulnerability allows unauthenticated network callers to access sensitive information such as session tokens and engine state, and to tamper with developer-defined resources. Such unauthorized access and potential data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and secure handling of authentication credentials.

Specifically, the exposure of session tokens and the ability to invoke API server resources without authentication may violate principles of data confidentiality and integrity mandated by these standards.

Hi! I’m here to help you understand CVE-2026-55884. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70