Executive brief
Tilt, a tool for managing microservice development environments on Kubernetes, contains a security flaw in its Heads-Up Display (HUD) interface. If the HUD is exposed to a network, an unauthorized attacker can bypass security checks to view sensitive development data, including session states and configuration files. This could lead to the exposure of proprietary code and internal infrastructure details.
Technical details
Tilt versions 0.24.0 through 0.37.3 are vulnerable to an authentication bypass in the HUD WebSocket at /ws/view. While the endpoint is intended to be gated by a CSRF token, the token is served via an unauthenticated /api/websocket_token endpoint. Furthermore, the WebSocket upgrader incorrectly validates clients that omit the Origin header. If Tilt is configured to listen on a network-accessible interface (e.g., via --host 0.0.0.0), a remote attacker can establish a WebSocket connection to intercept the full view stream, including Tiltfile contents and resource statuses. The issue is resolved in version 0.37.4 by requiring a CSRF token for all WebSocket upgrades and removing the insecure origin fallback.
Affected products
- tilt-dev Tilt >= 0.24.0, < 0.37.4
Timeline
- 2026-06-15: patched: Fix committed to master branch
- 2026-06-16: advisory: Version 0.37.4 released
- 2026-07-10: disclosed: CVE-2026-55883 published