Tilt, a tool for defining dev environments as code for Kubernetes microservice apps, included Go net/http/pprof handlers mounted under /debug without access control from versions 0.19.5 through 0.37.3. When the HUD or apiserver listener is exposed to a network, unauthenticated attackers can access endpoints such as /debug/pprof/heap and /debug/pprof/goroutine to read process memory, potentially exposing session and apiserver tokens. Additionally, attackers can degrade performance by invoking /debug/pprof/profile or /debug/pprof/trace. This vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 4.0 base score of 8.3 (high severity). The issue is resolved in Tilt version 0.37.4.

An unauthenticated attacker with network access to the Tilt HUD or apiserver listener can read sensitive process memory, including session and apiserver tokens, potentially leading to unauthorized access. The attacker can also degrade system performance by triggering profiling endpoints. This exposure compromises confidentiality and availability of the affected system components.

Upgrade Tilt to version 0.37.4 or later, where this vulnerability is fixed. There is no official patch or temporary fix other than upgrading. Restrict network exposure of the HUD and apiserver listeners to trusted users until the upgrade is applied.