CVE-2026-55883 Details
Description
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader accepts clients that omit an Origin header. When the HUD is network-exposed, an attacker who can reach the listener can open the HUD WebSocket and receive the full view stream, including session state, Tiltfile contents, resource statuses, and continued updates. This issue is fixed in version 0.37.4.
A cross-site WebSocket hijacking vulnerability has been identified in Tilt versions 0.24.0 prior to 0.37.3. The issue arises because the Tilt HUD WebSocket at '/ws/view' relies on a CSRF token, which is provided by an unauthenticated endpoint. Additionally, the WebSocket upgrader accepts connections that omit the 'Origin' header. When the HUD is exposed to the network, an attacker can exploit this flaw to access the full view stream, including session state, Tiltfile contents, resource statuses, and ongoing updates.
Users can upgrade to Tilt version 0.37.4, which addresses this vulnerability by requiring a valid CSRF token for WebSocket connections and adding middleware to validate the 'Origin' header.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a | [email protected] | Source CodeVendor |
| https://github.com/tilt-dev/tilt/pull/6776 | [email protected] | Issue TrackingVendor |
| https://github.com/tilt-dev/tilt/releases/tag/v0.37.4 | [email protected] | Release NotesVendor |
| https://github.com/tilt-dev/tilt/security/advisories/GHSA-6m68-r693-78qx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tilt | >= 0.24.0, <= 0.37.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |