https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 13:47:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336155 EUVD-2026-336155 https://cve.radiocsirt.org/vuln/euvd-2026-336155 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55882 <p>Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.</p> <p>Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memory through /debug/pprof/heap and /debug/pprof/goroutine, including session and apiserver tokens, and degrade performance through /debug/pprof/profile or /debug/pprof/trace. This issue is fixed in version 0.37.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55882 https://cve.radiocsirt.org/vuln/ghsa-p749-9w62-w533 <p><strong>Affected:</strong> Go: github.com/tilt-dev/tilt</p> <p>## Summary The Tilt HUD server mounts Go&#39;s `net/http/pprof` handlers under `/debug` with no access control. When the HUD is network-exposed, an attacker can read process memory — including session and apiserver tokens — and hold the process under profiling.</p> <p>## Details A blank import of `net/http/pprof` registers its handlers on `http.DefaultServeMux`, which the HUD controller mounts under `/debug` on both the web router and the apiserver listener. `/debug/pprof/heap` and `/goroutine` expose process memory, including the session token (also issued in the `Tilt-Token` cookie) and the apiserver loopback bearer token; `/profile` and `/trace` let a caller sample the process for an arbitrary duration.</p> <p>## Impact An unauthenticated caller who can reach the listener can extract process memory — including the session and apiserver tokens — and degrade performance by holding the process under CPU profiling or tracing. The leaked tokens compound the missing-authentication finding on the same server.</p> <p>### Conditions for exploitation - Affected version in `&gt;= 0.19.5, &lt;= 0.37.3`. - HUD (or apiserver) listener bound to a non-loopback address (`tilt up --host 0.0.0.0`, or `TILT_HOST` set). - Network reachability to the listener (default port `10350`).</p> <p>### Not affected - The default loopback-only bind is not reachable from the network.</p> <p>## Workarounds Use the default loopback bind (omit `--host`, unset `TILT_HOST`) so `/debug` is not remotely reachable. No complete workaround short of upgr…</p> <p><strong>Affected:</strong> Go: github.com/tilt-dev/tilt</p> <p>## Summary The Tilt HUD server mounts Go&#39;s `net/http/pprof` handlers under `/debug` with no access control. When the HUD is network-exposed, an attacker can read process memory — including session and apiserver tokens — and hold the process under profiling.</p> <p>## Details A blank import of `net/http/pprof` registers its handlers on `http.DefaultServeMux`, which the HUD controller mounts under `/debug` on both the web router and the apiserver listener. `/debug/pprof/heap` and `/goroutine` expose process memory, including the session token (also issued in the `Tilt-Token` cookie) and the apiserver loopback bearer token; `/profile` and `/trace` let a caller sample the process for an arbitrary duration.</p> <p>## Impact An unauthenticated caller who can reach the listener can extract process memory — including the session and apiserver tokens — and degrade performance by holding the process under CPU profiling or tracing. The leaked tokens compound the missing-authentication finding on the same server.</p> <p>### Conditions for exploitation - Affected version in `&gt;= 0.19.5, &lt;= 0.37.3`. - HUD (or apiserver) listener bound to a non-loopback address (`tilt up --host 0.0.0.0`, or `TILT_HOST` set). - Network reachability to the listener (default port `10350`).</p> <p>### Not affected - The default loopback-only bind is not reachable from the network.</p> <p>## Workarounds Use the default loopback bind (omit `--host`, unset `TILT_HOST`) so `/debug` is not remotely reachable. No complete workaround short of upgr…</p> https://cve.radiocsirt.org/vuln/ghsa-p749-9w62-w533