CVE-2026-55884 is a missing authentication vulnerability (CWE-306) in the tilt-dev tilt product affecting versions >=0.20.8 and <0.37.4. The issue arises because the Tilt HUD HTTP server uses a gorilla/mux router without authenticating middleware. When the HUD binds to a non-loopback address, unauthenticated remote attackers can trigger developer-defined resources, tamper with Tiltfile arguments, read the full engine state including session tokens, and invoke Kubernetes apiserver resources through a token-attaching /proxy handler. This allows unauthorized access and manipulation of critical functions. The vulnerability has a CVSS 4.0 base score of 9.2 (critical severity). The issue is resolved in version 0.37.4.

An unauthenticated remote attacker can exploit this vulnerability when the Tilt HUD is bound to a non-loopback interface, enabling them to execute developer-defined resources, modify Tiltfile arguments, access sensitive engine state data including session tokens, and invoke Kubernetes apiserver resources through the /proxy handler. This leads to unauthorized access and potential control over critical development environment functions.

This vulnerability is fixed in tilt version 0.37.4. Users should upgrade to version 0.37.4 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgrading, avoid binding the Tilt HUD HTTP server to non-loopback addresses to reduce exposure.