Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-55884— Tilt: Missing authentication on the network-exposed Tilt HUD server

Quick assessment

Affected

tilt-dev tilt

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tilt Dev Tilt是Tilt Dev团队的一款持续集成与交付的微服务开发工具。 Tilt Dev Tilt 0.20.8版本至0.37.3版本存在授权问题漏洞，该漏洞源于Tilt HUD HTTP服务器在gorilla/mux路由器上注册处理程序时未使用身份验证中间件，可能导致未经身份验证的网络调用者在HUD绑定到非回环地址时触发开发者定义的资源、篡改Tiltfile参数、读取包括会话令牌在内的完整引擎状态，并通过token-attaching的/proxy处理程序调用apiserver资源。

CVSS 9.2 · Critical EPSS 0.50% · P42 Updated Jul 30, 2026

Possible ATT&CK Techniques 2 AI

T1528 · Steal Application Access Token T1078 · Valid Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
tilt-dev	tilt	`>= 0.20.8, < 0.37.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55884

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tilt: Missing authentication on the network-exposed Tilt HUD server

Source: CVE Program / CVE List V5

Vulnerability Description

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Vulnerability Title

Tilt Dev Tilt 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tilt-dev	tilt	>= 0.20.8, < 0.37.4	-

II. Public POCs for CVE-2026-55884

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-55884

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55884 (2)

Vendor Advisories for CVE-2026-55884 (1)

🔗 Missing authentication on the network-exposed Tilt HUD server · Advisory · tilt-dev/tilt · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-55884 (1)

🔗 Release v0.37.4 · tilt-dev/tilt · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-55884

Same Patch Batch · tilt-dev · 2026-07-10 · 3 CVEs total

CVE-2026-55882		Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
CVE-2026-55883		Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

IV. Related Vulnerabilities

Same product: tilt

Same vendor: tilt-dev

Same weakness: CWE-306