Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-55883Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

High 8.3

In plain English

A high-severity insufficient verification of data authenticity in tilt from tilt-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader accepts clients that omit an Origin header. When the HUD is network-exposed, an attacker who can reach the listener can open the HUD WebSocket and receive the full view stream, including session state, Tiltfile contents, resource statuses, and continued updates. This issue is fixed in version 0.37.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tilt-dev/tilt	0.37.4	GHSA-6m68-r693-78qx
Go	github.com/tilt-dev/tilt	0.37.4	GO-2026-5181

Affected products (as reported)

Vendor	Product	Versions
tilt-dev	tilt	>= 0.24.0, < 0.37.4

Weakness: CWE-345 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/tilt-dev/tilt/security/advisories/GHSA-6m68-r693-78qx x_refsource_CONFIRM
https://github.com/tilt-dev/tilt/pull/6776 x_refsource_MISC
https://github.com/tilt-dev/tilt/commit/47393fba7f6ef5e305d5e814551feef8e4acbc0a x_refsource_MISC
https://github.com/tilt-dev/tilt/releases/tag/v0.37.4 x_refsource_MISC