{"id":"EUVD-2026-43110","enisaUuid":"18969519-db03-3ac3-a681-462836460898","description":"Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.","datePublished":"Jul 10, 2026, 9:36:18 PM","dateUpdated":"Jul 29, 2026, 7:26:45 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","aliases":"CVE-2026-55884\nGHSA-c73q-8xxr-rgqm\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"4cf65d41-0b21-3fbf-9259-8a0ab5471952","product":{"name":"tilt","vendor":{"name":"tilt-dev"}},"product_version":"0.20.8, \u003c 0.37.4"}],"enisaIdVendor":[{"id":"4b1f0644-2bab-3ba2-9ce3-294b4ed07c39","vendor":{"name":"tilt-dev"}}],"enisaIdVulnerability":[{"id":"4bee1744-524d-377a-9819-14851024bd2d","vulnerability":{"id":"CVE-2026-55884","description":"Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4.","datePublished":"Jul 10, 2026, 9:36:18 PM","dateUpdated":"Jul 29, 2026, 7:26:45 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","enisa_id":"EUVD-2026-43110\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Nov 5, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"36191c38-6e65-3071-988d-ab12adc4e6ec","product":{"name":"tilt","vendor":{"name":"tilt-dev"}},"product_version":"0.20.8, \u003c 0.37.4"}],"vulnerabilityVendor":[{"id":"6bd72740-097d-39e4-bd52-7f1f87da7016","vendor":{"name":"tilt-dev"}}]}},{"id":"9dc82667-48d6-3b37-8c59-df08e8b82008","vulnerability":{"id":"GHSA-c73q-8xxr-rgqm","description":"Tilt: Missing authentication on the network-exposed Tilt HUD server","datePublished":"Jun 19, 2026, 1:58:13 PM","dateUpdated":"Jun 19, 2026, 1:58:13 PM","baseScore":0.0,"references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","enisa_id":"EUVD-2026-43110\n","aliases":"GHSA-c73q-8xxr-rgqm\nCVE-2026-55884\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}