Zurück zur CVE-Übersicht
CVE-2026-55884
NONERisk Signal Score10/100 — NIEDRIG
- Weniger als 24 Stunden alt
Beschreibung
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.
GitHub Advisories
GHSA-c73q-8xxr-rgqmCRITICAL
Tilt: Missing authentication on the network-exposed Tilt HUD server
go/github.com/tilt-dev/tilt→ 0.37.4
GitHub Advisory