CVE-2026-55884

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55884", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T16:59:42.759Z", "datePublished": "2026-07-10T21:36:18.861Z", "dateUpdated": "2026-07-29T19:26:45.343Z"}, "containers": {"cna": {"title": "Tilt: Missing authentication on the network-exposed Tilt HUD server", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm"}, {"name": "https://github.com/tilt-dev/tilt/pull/6776", "tags": ["x_refsource_MISC"], "url": "https://github.com/tilt-dev/tilt/pull/6776"}, {"name": "https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a"}, {"name": "https://github.com/tilt-dev/tilt/releases/tag/v0.37.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/tilt-dev/tilt/releases/tag/v0.37.4"}], "affected": [{"vendor": "tilt-dev", "product": "tilt", "versions": [{"version": ">= 0.20.8, < 0.37.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T21:36:18.861Z"}, "descriptions": [{"lang": "en", "value": "Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4."}], "source": {"advisory": "GHSA-c73q-8xxr-rgqm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55884", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T04:01:09.657710Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:26:45.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55884", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T04:01:09.657710Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T16:15:38.239Z"}}], "cna": {"title": "Tilt: Missing authentication on the network-exposed Tilt HUD server", "source": {"advisory": "GHSA-c73q-8xxr-rgqm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "tilt-dev", "product": "tilt", "versions": [{"status": "affected", "version": ">= 0.20.8, < 0.37.4"}]}], "references": [{"url": "https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm", "name": "https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tilt-dev/tilt/pull/6776", "name": "https://github.com/tilt-dev/tilt/pull/6776", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a", "name": "https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tilt-dev/tilt/releases/tag/v0.37.4", "name": "https://github.com/tilt-dev/tilt/releases/tag/v0.37.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T21:36:18.861Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55884", "state": "PUBLISHED", "dateUpdated": "2026-07-29T19:26:45.343Z", "dateReserved": "2026-06-17T16:59:42.759Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T21:36:18.861Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tilt", "vendor": "tilt-dev", "versions": [{"status": "affected", "version": ">= 0.20.8, < 0.37.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources through the token-attaching /proxy handler. This issue is fixed in version 0.37.4."}, {"lang": "es", "value": "Tilt define los entornos de desarrollo como c\u00f3digo para aplicaciones de microservicios en Kubernetes. Desde la versi\u00f3n 0.20.8 hasta la 0.37.3, el servidor HTTP del HUD de Tilt registra gestores en un router gorilla/mux sin middleware de autenticaci\u00f3n. Cuando el HUD est\u00e1 enlazado a una direcci\u00f3n que no es de loopback, un llamador de red no autenticado puede activar recursos definidos por el desarrollador, manipular los argumentos de Tiltfile, leer el estado completo del motor incluyendo el token de sesi\u00f3n, e invocar recursos del apiserver a trav\u00e9s del gestor /proxy que adjunta el token. Este problema est\u00e1 solucionado en la versi\u00f3n 0.37.4."}], "id": "CVE-2026-55884", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55884", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T04:01:09.657710Z", "version": "2.0.3"}}]}, "published": "2026-07-10T22:16:44.423", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a"}, {"source": "security-advisories@github.com", "url": "https://github.com/tilt-dev/tilt/pull/6776"}, {"source": "security-advisories@github.com", "url": "https://github.com/tilt-dev/tilt/releases/tag/v0.37.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/tilt-dev/tilt/security/advisories/GHSA-c73q-8xxr-rgqm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.20.8,0.37.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tilt", "source": "cna", "vendor": "tilt-dev"}, "product": "tilt", "vendor": "tilt-dev"}], "created": "2026-07-11T10:30:05.143389+00:00", "updated": "2026-08-01T12:00:05.613572+00:00", "vendors": ["tilt-dev", "tilt-dev$PRODUCT$tilt"]}