Tilt, a tool for defining dev environments as code for Kubernetes microservice apps, included Go net/http/pprof debug handlers mounted under /debug without access control in versions 0.19.5 through 0.37.3. When the HUD or apiserver listener is exposed to the network, unauthenticated attackers can access endpoints like /debug/pprof/heap and /debug/pprof/goroutine to read process memory, potentially exposing session and apiserver tokens. Attackers can also degrade performance by invoking /debug/pprof/profile or /debug/pprof/trace. This vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 4.0 score of 8.3 (high severity). The issue is resolved in Tilt version 0.37.4.

An unauthenticated remote attacker can access debug profiling endpoints to read sensitive process memory, including session and apiserver tokens, leading to exposure of sensitive information. Additionally, attackers can degrade the performance of the Tilt HUD or apiserver by triggering profiling or tracing endpoints. This can compromise confidentiality and availability of the affected service.

Upgrade Tilt to version 0.37.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid exposing the HUD or apiserver listener to untrusted networks to prevent unauthorized access to the /debug endpoints.