Cpe:2.3:a:kruize:autotune:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akruizeautotune/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 19:50:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKruize Autotune: REST API authentication bypass and credential exposure (CVE-2026-110975)https://feed.craftedsignal.io/briefs/2026-10-kruize-autotune-auth-bypass/Fri, 23 Oct 2026 19:50:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kruize-autotune-auth-bypass/Kruize Autotune contains an authentication bypass in its REST API that exposes sensitive monitoring datasource credentials in cleartext via improperly serialized JSON responses.A vulnerability in Kruize Autotune (CVE-2026-110975) allows unauthenticated users to access sensitive datasource configuration details. Specifically, the endpoints '/datasources' and 'datasource-metadata' fail to implement authentication checks. Due to insecure default Gson serialization settings, the application returns datasource objects containing plain-text secrets, including basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. An attacker with network reach to the Autotune API can retrieve these credentials to gain unauthorized access to the connected monitoring stack.

Impact

Successful exploitation results in the unauthorized disclosure of cleartext credentials used to access connected monitoring systems. This impact is limited to the credentials managed and stored within the Kruize Autotune datasource configuration.

Recommendation

  • Inventory all Kruize Autotune deployments and restrict network access to the REST API to trusted IP ranges only via network segmentation or firewall rules.
  • Audit the monitoring stack for any anomalous access or credential usage following potential exposure via the Autotune service.
  • Monitor for and apply vendor-provided security patches once available to remediate the insecure API endpoints and serialization logic.
]]>highadvisoryauthentication-bypasscredential-exposurewebservercve-2026-110975