CVE-2026-55884

Name of the Vulnerable Software and Affected Versions Tilt versions 0.20.8 through 0.37.3

Description The HUD HTTP server lacks authentication for state-changing and sensitive-read endpoints. When the HUD is bound to a non-loopback address, a network attacker can trigger pre-defined Tiltfile resources, modify Tiltfile arguments, and access the full engine state, including the session token. Additionally, the attacker can reach the Tilt apiserver through a token-attaching proxy. This occurs because the server registers handlers on a gorilla/mux router without authenticating middleware, and the cookieWrapper helper fails to validate the Tilt-Token cookie.

Recommendations Update Tilt to a version later than 0.37.3. Use the default loopback bind by omitting the --host flag and unsetting the TILT HOST variable. Ensure no external services proxy traffic to localhost:10350.