CVE-2026-55883

Name of the Vulnerable Software and Affected Versions Tilt versions 0.24.0 through 0.37.3

Description The Tilt HUD WebSocket endpoint /ws/view is susceptible to Cross-site WebSocket Hijacking (CSWSH), a technique where an attacker tricks a victim's browser into establishing a WebSocket connection to a vulnerable server. The connection is gated by a CSRF token, but this token is served as text/plain by an unauthenticated handler at the /api/websocket token endpoint, allowing any reachable caller to retrieve it. Additionally, the upgrader accepts connections from non-browser clients that omit the Origin header. If the HUD is bound to a non-loopback address, an attacker can open the HUD stream to read the developer's session state, including Tiltfile contents and resource statuses.

Recommendations Update Tilt to a version later than 0.37.3. Use the default loopback bind by omitting the --host flag and unsetting the TILT HOST variable.