CVE-2026-55884 tilt-dev CVE debrief

Who should care

Users of Tilt, especially those binding the HUD to a non-loopback address, should update to version 0.37.4 to mitigate this critical vulnerability. Affected operators, platform administrators, vulnerability management teams, and security teams should review the CVE record and NVD entry for details on the vulnerability and fixed version.

Technical summary

The Tilt HUD HTTP server lacks authenticating middleware, allowing unauthenticated network callers to trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state, and invoke apiserver resources when bound to a non-loopback address. This issue affects Tilt versions from 0.20.8 through 0.37.3 and is fixed in version 0.37.4. The vulnerability has a CVSS score of 9.2 and is considered critical.

Defensive priority

High

Recommended defensive actions

• Update Tilt to version 0.37.4 or later
• Review and restrict HUD binding to loopback addresses where possible
• Monitor Tilt HUD exposure and access controls
• Implement additional authentication and authorization measures for Tilt HUD
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The source item URL and references offer additional context. Evidence is limited, and defenders should verify Tilt HUD exposure and access controls. The vulnerability allows unauthenticated network callers to trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources when bound to a non-loopback address.

Official resources