Tilt-dev vulnerabilities
We track 3 vulnerabilities in Tilt-dev products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest Tilt-dev vulnerabilities
- 9.2 Critical severity
tilt: Missing Authentication for Critical Functionality
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an un
- 8.3 High severity
tilt: Insufficient Verification of Data Authenticity
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader ac
- 8.3 High severity
tilt: Exposure of Sensitive Information to an Unauthorized Actor
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthen