{"id":"EUVD-2026-43111","enisaUuid":"ec8444de-8454-3240-8acd-1e2333ce2f34","description":"Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.","datePublished":"Jul 10, 2026, 9:37:12 PM","dateUpdated":"Jul 13, 2026, 6:54:59 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-p749-9w62-w533\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","aliases":"CVE-2026-55882\nGHSA-p749-9w62-w533\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"695fb3f1-4b79-34ee-bdc3-4c587769ae76","product":{"name":"tilt","vendor":{"name":"tilt-dev"}},"product_version":"0.19.5, \u003c 0.37.4"}],"enisaIdVendor":[{"id":"a7a58a02-9280-36da-9365-18f6728c039f","vendor":{"name":"tilt-dev"}}],"enisaIdVulnerability":[{"id":"10b4e54c-7f8c-37a1-94a1-396267f332b1","vulnerability":{"id":"CVE-2026-55882","description":"Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.","datePublished":"Jul 10, 2026, 9:37:12 PM","dateUpdated":"Jul 13, 2026, 6:54:59 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-p749-9w62-w533\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","enisa_id":"EUVD-2026-43111\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Nov 3, 2026, 7:17:26 AM","vulnerabilityProduct":[{"id":"772263fa-196a-3221-b9b2-0f795d68ae2d","product":{"name":"tilt","vendor":{"name":"tilt-dev"}},"product_version":"0.19.5, \u003c 0.37.4"}],"vulnerabilityVendor":[{"id":"a0da08ea-114e-35b1-bf12-b52f897f84f7","vendor":{"name":"tilt-dev"}}]}},{"id":"ecc9eff8-dfce-3297-98de-b42d73a7d231","vulnerability":{"id":"GHSA-p749-9w62-w533","description":"Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server","datePublished":"Jun 19, 2026, 1:52:17 PM","dateUpdated":"Jun 19, 2026, 1:52:17 PM","baseScore":0.0,"references":"https://github.com/tilt-dev/tilt/security/advisories/GHSA-p749-9w62-w533\nhttps://github.com/tilt-dev/tilt/pull/6776\nhttps://github.com/tilt-dev/tilt\nhttps://github.com/tilt-dev/tilt/releases/tag/v0.37.4\n","enisa_id":"EUVD-2026-43111\n","aliases":"GHSA-p749-9w62-w533\nCVE-2026-55882\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}