CVE-2026-55882: Tilt Information Disclosure Vulnerability

CVE-2026-55882 Overview

CVE-2026-55882 affects Tilt, a development environment tool that defines microservice apps for Kubernetes as code. Versions 0.19.5 through 0.37.3 mount Go net/http/pprof handlers under the /debug path on the HUD server without any access control. When the HUD or apiserver listener is exposed on the network, an unauthenticated attacker can read process memory through /debug/pprof/heap and /debug/pprof/goroutine. These memory dumps contain session tokens and apiserver tokens. Attackers can also degrade performance by calling /debug/pprof/profile or /debug/pprof/trace. The issue is fixed in Tilt version 0.37.4.

Critical Impact
Unauthenticated network attackers can extract session and apiserver tokens from Tilt process memory and use them to gain full control of the developer's Kubernetes-adjacent workflow.

Affected Products

Tilt versions 0.19.5 through 0.37.3
Tilt HUD server listener with net/http/pprof handlers under /debug
Tilt apiserver listener when bound to non-loopback interfaces

Discovery Timeline

2026-07-10 - CVE-2026-55882 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55882

Vulnerability Analysis

The vulnerability is an information exposure issue categorized under [CWE-200]. Tilt's HUD server registers Go's net/http/pprof profiling handlers on the /debug route path. These handlers are intended for local development debugging and expose runtime introspection endpoints. The Tilt implementation applies no authentication, authorization, or origin checks to these routes. Any client that can reach the HUD or apiserver listener can invoke them.

The /debug/pprof/heap endpoint returns a heap dump of the running Go process. The /debug/pprof/goroutine endpoint returns full goroutine stacks including in-memory variables. Both endpoints leak sensitive strings held in memory, including Tilt session tokens and apiserver tokens. Attackers who capture these tokens can authenticate to the apiserver and control Tilt operations remotely.

Root Cause

The root cause combines two design decisions. First, net/http/pprof handlers were registered on the primary HUD listener without a separate diagnostics mux. Second, the default --host flag accepted values such as 0.0.0.0 without warning developers about the security implications. This allowed the debug surface to reach networks beyond localhost.

Attack Vector

An unauthenticated attacker on the same network as an exposed Tilt HUD sends an HTTP GET request to /debug/pprof/heap or /debug/pprof/goroutine. The attacker parses the returned pprof profile for token strings. With the extracted tokens, the attacker authenticates to Tilt's apiserver. Attackers can also send requests to /debug/pprof/profile and /debug/pprof/trace to force CPU-intensive profiling that degrades Tilt performance.

// Security patch in internal/cli/flags.go
// For commands that start a web server.
func addStartServerFlags(cmd *cobra.Command) {
	cmd.Flags().IntVar(&webPortFlag, "port", defaultWebPort, "Port for the Tilt HTTP server. Set to 0 to disable. Overrides TILT_PORT env variable.")
-	cmd.Flags().StringVar(&webHostFlag, "host", defaultWebHost, "Host for the Tilt HTTP server and default host for any port-forwards. Set to 0.0.0.0 to listen on all interfaces. Overrides TILT_HOST env variable.")
+	cmd.Flags().StringVar(&webHostFlag, "host", defaultWebHost, "Host for the Tilt HTTP server and default host for any port-forwards. Defaults to localhost; only change this if you need remote access and understand the security implications. Overrides TILT_HOST env variable.")
}

Source: GitHub Commit 47393fb. The patch narrows the default listener to localhost and warns operators before binding to remote interfaces.

Detection Methods for CVE-2026-55882

Indicators of Compromise

HTTP requests to /debug/pprof/heap, /debug/pprof/goroutine, /debug/pprof/profile, or /debug/pprof/trace on Tilt HUD ports from non-loopback addresses
Tilt HUD or apiserver listeners bound to 0.0.0.0 or a routable interface in process arguments
Unexpected outbound authentication attempts to the Tilt apiserver using valid session tokens from unfamiliar source addresses
Sudden CPU spikes on developer workstations correlated with inbound requests to Tilt HUD ports

Detection Strategies

Inspect running processes for tilt invocations that pass --host 0.0.0.0 or a non-localhost TILT_HOST environment variable
Monitor web proxy and firewall logs for HTTP paths containing /debug/pprof/ reaching developer machines or CI runners
Query package manifests and container images for tilt binaries at versions between 0.19.5 and 0.37.3

Monitoring Recommendations

Alert on any TCP connection to Tilt default ports originating outside the loopback interface
Log and review HTTP request paths on developer workstation HTTP listeners for pprof access patterns
Track Tilt version telemetry across engineering fleets and flag hosts running vulnerable releases

How to Mitigate CVE-2026-55882

Immediate Actions Required

Upgrade all Tilt installations to version 0.37.4 or later
Audit running Tilt instances and terminate any process bound to a non-loopback interface
Rotate any Tilt session tokens and apiserver tokens that may have been in memory during network exposure
Restrict network access to developer workstation ports through host firewalls and network segmentation

Patch Information

The fix is available in Tilt v0.37.4. Technical details are documented in the GitHub Security Advisory GHSA-p749-9w62-w533 and the pull request discussion. The patch secures mutating and sensitive HUD server routes and changes the default --host guidance to require explicit intent before exposing the server beyond localhost.

Workarounds

Bind the Tilt HUD to localhost only by omitting the --host flag or setting TILT_HOST=127.0.0.1
Block inbound traffic to Tilt default ports at the host firewall on developer machines
Front the HUD with an authenticating reverse proxy that rejects requests to /debug/pprof/*
Avoid running vulnerable Tilt versions inside shared Kubernetes clusters or over VPNs that expose developer ports

bash

# Configuration example - restrict Tilt HUD to loopback
export TILT_HOST=127.0.0.1
export TILT_PORT=10350
tilt up --host 127.0.0.1

# Verify the listener is not exposed on external interfaces
ss -tlnp | grep tilt