Kruize CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Kruize CVE published 2026-10-23

CVE-2026-110975

A flaw in Kruize Autotune's REST API allows unauthenticated clients to obtain sensitive credentials for configured monitoring datasources, including basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets. This vulnerability enables attackers with network access to harvest credentials and potentially reuse them to authenticate to the backing monitoring stack. Defenders responsible for Kru [truncated]