Tilt defines dev environments as code for microservice applications on Kubernetes. Versions from 0.19.5 through 0.37.3 expose Go net/http/pprof handlers under the /debug path without any access control. When the HUD or API server listener is reachable over a network, an unauthenticated user can request /debug/pprof/heap and /debug/pprof/goroutine to read the process memory, capturing sensitive data such as session and API server tokens. Additionally, calling /debug/pprof/profile or /debug/pprof/trace can degrade performance. This vulnerability results in an information exposure flaw that permits unauthenticated disclosure of runtime data. The issue was resolved in Tilt 0.37.4.

The affected product is Tilt (tilt-dev:tilt). Vulnerable versions range from 0.19.5 up to and including 0.37.3. The defect was addressed in Tilt 0.37.4.

With a CVSS score of 8.3 the vulnerability is considered high severity. The EPSS figure of < 1 % indicates a very low current exploitation probability. It is not listed in the CISA KEV catalog. If the Tilt HUD server or API listener is reachable over a network, an unauthenticated attacker can issue HTTP requests to any /debug/pprof path to read sensitive data—including session and API server tokens—and to trigger profiling or tracing operations that can degrade performance. The absence of authentication or network restrictions makes exploitation straightforward under these conditions.