Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader accepts clients that omit an Origin header. When the HUD is network‑exposed, an attacker who can reach the listener can open the HUD WebSocket and receive the full view stream, including session state, Tiltfile contents, resource statuses, and continued updates. This provides an attacker with confidential operational data. The issue is fixed in version 0.37.4.

The affected product is Tilt from tilt‑dev. All releases from 0.24.0 through 0.37.3 contain the flaw. The vulnerability is addressed in version 0.37.4; no other vendors or products are listed.

The CVSS score of 8.3 indicates high severity. The EPSS score of <1% suggests that exploitation is unlikely but not impossible. The vulnerability is not present in the CISA KEV catalog. Based on the description, the attack vector most likely requires network connectivity to the Tilt server; an attacker that can connect to the listening endpoint can establish the WebSocket and receive the divulged data.