GHSA-p749-9w62-w533

Source

https://github.com/advisories/GHSA-p749-9w62-w533

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p749-9w62-w533/GHSA-p749-9w62-w533.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p749-9w62-w533

Aliases

Published

2026-06-19T13:52:17Z

Modified

2026-06-25T23:11:06Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

Details

Summary

The Tilt HUD server mounts Go's net/http/pprof handlers under /debug with no access control. When the HUD is network-exposed, an attacker can read process memory — including session and apiserver tokens — and hold the process under profiling.

Details

A blank import of net/http/pprof registers its handlers on http.DefaultServeMux, which the HUD controller mounts under /debug on both the web router and the apiserver listener. /debug/pprof/heap and /goroutine expose process memory, including the session token (also issued in the Tilt-Token cookie) and the apiserver loopback bearer token; /profile and /trace let a caller sample the process for an arbitrary duration.

Impact

An unauthenticated caller who can reach the listener can extract process memory — including the session and apiserver tokens — and degrade performance by holding the process under CPU profiling or tracing. The leaked tokens compound the missing-authentication finding on the same server.

Conditions for exploitation

Affected version in >= 0.19.5, <= 0.37.3.
HUD (or apiserver) listener bound to a non-loopback address (tilt up --host 0.0.0.0, or TILT_HOST set).
Network reachability to the listener (default port 10350).

Not affected

The default loopback-only bind is not reachable from the network.

Workarounds

Use the default loopback bind (omit --host, unset TILT_HOST) so /debug is not remotely reachable. No complete workaround short of upgrading for non-loopback deployments.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T13:52:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/tilt-dev/tilt

Package

Name: github.com/tilt-dev/tilt; View open source insights on deps.dev
Purl: pkg:golang/github.com/tilt-dev/tilt

Affected ranges

Type: SEMVER
Events: Introduced

0.19.5

Fixed

0.37.4

Database specific

last_known_affected_version_range

"<= 0.37.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p749-9w62-w533/GHSA-p749-9w62-w533.json"