CVE-2026-110975: Plaintext Storage of a Password

Kruize Autotune's REST API does not implement an authentication layer, and its endpoints that return datasource configurations (GET /datasources and datasource-metadata) serialize datasource objects without excluding sensitive fields. Consequently, authentication secrets including basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets are exposed in plaintext to any client able to access the service. An attacker with network access could retrieve these credentials and use them to authenticate to the underlying monitoring infrastructure. The vulnerability affects versions >=0 and <0.11.2.

The vulnerability allows an unauthenticated attacker with network access to the Kruize Autotune service to retrieve sensitive authentication credentials in plaintext. This exposure can lead to unauthorized access to the backing monitoring stack, potentially compromising monitoring data and infrastructure. The impact is confidentiality loss without direct integrity or availability impact.

No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-110975 for current remediation guidance. Until a fix is applied, restrict network access to the Autotune REST API to trusted clients only to prevent unauthorized credential disclosure.