CVE-2026-55882: Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

June 19, 2026

The Tilt HUD server mounts Go’s net/http/pprof handlers under /debug with no access control. When the HUD is network-exposed, an attacker can read process memory — including session and apiserver tokens — and hold the process under profiling.

References

github.com/advisories/GHSA-p749-9w62-w533
github.com/tilt-dev/tilt/pull/6776
github.com/tilt-dev/tilt/releases/tag/v0.37.4
github.com/tilt-dev/tilt/security/advisories/GHSA-p749-9w62-w533
nvd.nist.gov/vuln/detail/CVE-2026-55882

Code Behaviors & Features

Detect and mitigate CVE-2026-55882 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →