CVE-2026-55884CWE-306

Tilt: Missing authentication on the network-exposed Tilt HUD server

Critical · published July 10, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00496 · 41.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-10T21:36Z
EPSS history
Timeline
  • 10 JUL 21:36Z
    Tilt: Missing authentication on the network-exposed Tilt HUD server
    cvelistv5