CVE-2026-55884 describes a missing authentication vulnerability in the Tilt HUD HTTP server for versions >=0.20.8 and <0.37.4. The server registers HTTP handlers on a gorilla/mux router without authentication middleware. When the HUD is accessible on a non-loopback network interface, an unauthenticated attacker can access developer-defined resources, tamper with Tiltfile arguments, read the full engine state including session tokens, and use the /proxy handler to invoke Kubernetes apiserver resources with attached tokens. This allows unauthorized access and control over critical functions. The issue is resolved in version 0.37.4.

An unauthenticated remote attacker can exploit this vulnerability to execute critical functions without authorization, including reading sensitive session tokens, modifying developer environment configurations, and accessing Kubernetes apiserver resources through the compromised session token. This could lead to unauthorized control over microservice development environments and potentially broader Kubernetes cluster access depending on the environment configuration.

Upgrade tilt to version 0.37.4 or later, where this vulnerability is fixed. Until the upgrade is applied, ensure the Tilt HUD HTTP server is bound only to loopback addresses to prevent remote unauthenticated access. No other official fixes or temporary mitigations are documented.