Authentication Flaw in Kruize Autotune Exposing Secrets
CVE-2026-110975
What is CVE-2026-110975?
Kruize Autotune presents a significant vulnerability due to its REST API lacking an authentication layer. Specific endpoints, including the list-datasources and datasource-metadata endpoints, are susceptible to exposing sensitive authentication credentials such as basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. This occurs because these endpoints return serialized datasource objects without implementing any field-exclusion strategies, which means sensitive data can be accessed in cleartext by any client that can connect to the service. Consequently, this flaw poses a severe risk if an attacker gains network access to Autotune, allowing them to harvest and misuse these credentials against the underlying monitoring infrastructure.