Threats tagged 'ghsa-f9cv-pr2f-46v2'

Kruize Autotune's REST API lacks an authentication layer, exposing sensitive datasource configuration endpoints that return authentication secrets in cleartext. This allows any client with network access to the service to retrieve credentials such as basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. The vulnerability is tied to the network exposure of the service, which is often exposed via NodePort, LoadBalancer, or OpenShift Route configurations. The issue was fixed in version 0.11.2 by excluding sensitive fields from API responses and tightening CORS policies. However, credentials remain stored in cleartext at rest, which is a separate concern.