{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akruizeautotune/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kruize:autotune:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-110975"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Autotune"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","credential-exposure","webserver","cve-2026-110975"],"_cs_type":"advisory","_cs_vendors":["Kruize"],"content_html":"\u003cp\u003eA vulnerability in Kruize Autotune (CVE-2026-110975) allows unauthenticated users to access sensitive datasource configuration details. Specifically, the endpoints '/datasources' and 'datasource-metadata' fail to implement authentication checks. Due to insecure default Gson serialization settings, the application returns datasource objects containing plain-text secrets, including basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. An attacker with network reach to the Autotune API can retrieve these credentials to gain unauthorized access to the connected monitoring stack.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of cleartext credentials used to access connected monitoring systems. This impact is limited to the credentials managed and stored within the Kruize Autotune datasource configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Kruize Autotune deployments and restrict network access to the REST API to trusted IP ranges only via network segmentation or firewall rules.\u003c/li\u003e\n\u003cli\u003eAudit the monitoring stack for any anomalous access or credential usage following potential exposure via the Autotune service.\u003c/li\u003e\n\u003cli\u003eMonitor for and apply vendor-provided security patches once available to remediate the insecure API endpoints and serialization logic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T19:50:52Z","date_published":"2026-10-23T19:50:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kruize-autotune-auth-bypass/","summary":"Kruize Autotune contains an authentication bypass in its REST API that exposes sensitive monitoring datasource credentials in cleartext via improperly serialized JSON responses.","title":"Kruize Autotune: REST API authentication bypass and credential exposure (CVE-2026-110975)","url":"https://feed.craftedsignal.io/briefs/2026-10-kruize-autotune-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kruize:autotune:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}