Tilt, a tool for defining dev environments as code on Kubernetes, versions 0.24.0 through 0.37.3 expose a vulnerability (CWE-345) due to insufficient verification of data authenticity in the Tilt HUD WebSocket at /ws/view. The CSRF token protecting the WebSocket is obtained from an unauthenticated endpoint (/api/websocket_token), and the WebSocket upgrader accepts connections without verifying the Origin header. When the HUD is exposed on the network, an attacker able to reach the listener can open the WebSocket and receive the full view stream, including sensitive session state, Tiltfile contents, resource statuses, and ongoing updates. This vulnerability is addressed in version 0.37.4.

An attacker with network access to the Tilt HUD WebSocket can bypass CSRF protections and receive sensitive internal data streams, including session state and configuration files. This exposure could lead to information disclosure impacting confidentiality of the development environment and potentially enabling further attacks.

Upgrade Tilt to version 0.37.4 or later, where this vulnerability is fixed. Until then, avoid exposing the Tilt HUD WebSocket on untrusted networks to prevent unauthorized access. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue is fixed in 0.37.4.