Kruize Autotune: REST API authentication bypass and credential exposure (CVE-2026-110975)

A vulnerability in Kruize Autotune (CVE-2026-110975) allows unauthenticated users to access sensitive datasource configuration details. Specifically, the endpoints '/datasources' and 'datasource-metadata' fail to implement authentication checks. Due to insecure default Gson serialization settings, the application returns datasource objects containing plain-text secrets, including basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. An attacker with network reach to the Autotune API can retrieve these credentials to gain unauthorized access to the connected monitoring stack.

Impact

Successful exploitation results in the unauthorized disclosure of cleartext credentials used to access connected monitoring systems. This impact is limited to the credentials managed and stored within the Kruize Autotune datasource configuration.

Recommendation

• Inventory all Kruize Autotune deployments and restrict network access to the REST API to trusted IP ranges only via network segmentation or firewall rules.
• Audit the monitoring stack for any anomalous access or credential usage following potential exposure via the Autotune service.
• Monitor for and apply vendor-provided security patches once available to remediate the insecure API endpoints and serialization logic.