CVE-2026-55883: Tilt Cross-site WebSocket Hijacking in HUD interface

CVE-2026-55883 · Severity: high · CVSS 4 · Published 2026-07-10

Tilt, a tool for managing microservice development environments on Kubernetes, contains a security flaw in its Heads-Up Display (HUD) interface. If the HUD is exposed to a network, an unauthorized attacker can bypass security checks to view sensitive development data, including session states and configuration files. This could lead to the exposure of proprietary code and internal infrastructure details.

Technologies: github.com/tilt-dev/tilt (Go), Tilt. Vendors: Go, Tilt.

Quick answers

Is CVE-2026-55883 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55883 being exploited in the wild.
How severe is CVE-2026-55883?
High severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
github.com/tilt-dev/tilt (Go) >= 0.24.0, <= 0.37.3, SEMVER:introduced=0.24.0,fixed=0.37.4; Tilt >= 0.24.0, < 0.37.4, >= 0.24.0, <= 0.37.3.
Is there a fix for CVE-2026-55883?
Yes. github.com/tilt-dev/tilt (Go): upgrade to 0.37.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55883 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55883?
Check whether you run github.com/tilt-dev/tilt (Go) or Tilt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/tilt-dev/tilt (Go): upgrade to 0.37.4 or later
    go get github.com/tilt-dev/tilt@v0.37.4

Technical details

Tilt versions 0.24.0 through 0.37.3 are vulnerable to an authentication bypass in the HUD WebSocket at /ws/view. While the endpoint is intended to be gated by a CSRF token, the token is served via an unauthenticated /api/websocket_token endpoint. Furthermore, the WebSocket upgrader incorrectly validates clients that omit the Origin header. If Tilt is configured to listen on a network-accessible interface (e.g., via --host 0.0.0.0), a remote attacker can establish a WebSocket connection to intercept the full view stream, including Tiltfile contents and resource statuses. The issue is resolved in version 0.37.4 by requiring a CSRF token for all WebSocket upgrades and removing the insecure origin fallback.

Affected products

  • tilt-dev Tilt >= 0.24.0, < 0.37.4

Identifiers

  • CVE-2026-55883
  • GHSA-6m68-r693-78qx
  • GO-2026-5181

Timeline

  • 2026-06-15: patched: Fix committed to master branch
  • 2026-06-16: advisory: Version 0.37.4 released
  • 2026-07-10: disclosed: CVE-2026-55883 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.