What’s Vulnerable › Vulnerabilities

CVE-2026-55882: Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-10 · updated 2026-10-25
• Weakness: CWE-200

Description

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.

Affected products

• tilt-dev tilt: from 0.19.5, < 0.37.4

References

• https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a
• https://github.com/tilt-dev/tilt/pull/6776
• https://github.com/tilt-dev/tilt/releases/tag/v0.37.4
• https://github.com/tilt-dev/tilt/security/advisories/GHSA-p749-9w62-w533

Get alerted when CVE-2026-55882 or the next vulnerability affects your stack