CVE-2026-55884
- Source
- https://cve.org/CVERecord?id=CVE-2026-55884
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55884.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-55884
- Aliases
- Downstream
- Related
- Published
- 2026-07-10T21:36:18Z
- Modified
- 2026-10-16T02:31:40Z
- Severity
-
- 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Tilt: Missing authentication on the network-exposed Tilt HUD server
- Details
-
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-306" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55884.json" }- References
-
- https://github.com/tilt-dev/tilt/releases/tag/v0.37.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55884.json
- https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm
- https://nvd.nist.gov/vuln/detail/CVE-2026-55884
- https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a
- https://github.com/tilt-dev/tilt/pull/6776
Affected packages
Git / github.com/tilt-dev/tilt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tilt-dev/tilt
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.20.8" }, { "fixed": "0.37.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "47393fba7f6ef5e305d5e814551feef8e4acbc0a" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.37.4", "range": [ { "fixed": "0b591662e013ba2d551d4861009d7b3c2276c90e" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v0.*
v0.20.8
v0.20.9
v0.21.0
v0.21.1
v0.21.3
v0.22.0
v0.22.1
v0.22.10
v0.22.11
v0.22.12
v0.22.13
v0.22.14
v0.22.15
v0.22.2
v0.22.3
v0.22.4
v0.22.5
v0.22.6
v0.22.7
v0.22.8
v0.22.9
v0.23.0
v0.23.1
v0.23.2
v0.23.3
v0.23.4
v0.23.5
v0.23.6
v0.23.7
v0.23.8
v0.23.9
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.26.1
v0.26.2
v0.26.3
v0.27.0
v0.27.1
v0.27.2
v0.27.3
v0.28.0
v0.28.1
v0.29.0
v0.30.0
v0.30.1
v0.30.10
v0.30.11
v0.30.12
v0.30.13
v0.30.2
v0.30.3
v0.30.4
v0.30.5
v0.30.6
v0.30.7
v0.30.8
v0.30.9
v0.31.0
v0.31.1
v0.31.2
v0.32.0
v0.32.1
v0.32.2
v0.32.3
v0.32.4
v0.33.0
v0.33.1
v0.33.10
v0.33.11
v0.33.12
v0.33.13
v0.33.14
v0.33.15
v0.33.16
v0.33.17
v0.33.18
v0.33.19
v0.33.2
v0.33.20
v0.33.21
v0.33.22
v0.33.3
v0.33.4
v0.33.5
v0.33.6
v0.33.7
v0.33.8
v0.33.9
v0.34.0
v0.34.1
v0.34.2
v0.34.3
v0.34.4
v0.34.5
v0.35.0
v0.35.1
v0.35.2
v0.36.0
v0.36.1
v0.36.2
v0.36.3
v0.37.0
v0.37.1
v0.37.2
v0.37.3