Tilt defines dev environments as code for microservice apps on Kubernetes. From version 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non‑loopback address, an unauthenticated network caller can trigger developer‑defined resources, tamper with Tiltfile arguments, read the full engine state including the session token, and invoke apiserver resources through the token‑attaching /proxy handler. This issue is fixed in version 0.37.4. The weakness is classified as CWE‑306 (Missing Authentication).

Tilt, developed by tilt‑dev, is a tool that codifies microservice development environments on Kubernetes. All versions from 0.20.8 up to and including 0.37.3 are affected because the HUD server lacks authentication. The fix is in release v0.37.4, which restores authentication middleware.

The CVSS score of 9.2 indicates critical severity, and the EPSS score is < 1%, suggesting a low probability of exploitation, yet the vulnerability is not listed in KEV. The lack of authentication and the ability to impersonate a trusted user through the API proxy make this vulnerability highly exploitable for attackers who can reach the exposed HUD port. The likely attack vector is local or remote network access to the HUD endpoint when it is bound to a non‑loopback interface.