CVE-2026-55882: Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no ac

unknownCVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-55882

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-55882	coverage & exploitation status	NVD · CVE.org

Recent advisories for Tilt defines dev

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-55884: Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through…nvd · 2026-07-10
unknownCVE-2026-55883: Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through…nvd · 2026-07-10

CVE-2026-55882: Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no ac

Details

Referenced CVEs

Recent advisories for Tilt defines dev

More from NVD Recent CVEs