CVE-2026-55882
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
CVSS Score
0.0
EPSS Score
0.4%
EPSS Percentile
30th
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.
| CWE | CWE-200 |
| Vendor | tilt-dev |
| Product | tilt |
| Published | Jul 10, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for tilt-dev tilt
Be the first to know when new unknown vulnerabilities affecting tilt-dev tilt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
tilt-dev / tilt
>= 0.19.5, < 0.37.4