CVE-2026-55882

Name of the Vulnerable Software and Affected Versions Tilt versions 0.19.5 through 0.37.3

Description The Tilt HUD server mounts Go's net/http/pprof handlers under the '/debug' endpoint without access control. When the HUD is network-exposed, an unauthenticated caller can read process memory via '/debug/pprof/heap' and '/goroutine', potentially extracting session tokens and apiserver loopback bearer tokens. Additionally, the '/profile' and '/trace' endpoints allow a caller to sample the process for an arbitrary duration, which can degrade system performance. This issue occurs when the HUD or apiserver listener is bound to a non-loopback address, such as when using tilt up --host 0.0.0.0 or setting the TILT HOST variable.

Recommendations Update Tilt to a version later than 0.37.3. Use the default loopback bind by omitting the --host flag and unsetting the TILT HOST variable to ensure the '/debug' endpoint is not remotely reachable.