CVE-2026-92171
Red Hat Data Grid 8: Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
Red Hat Red Hat Data Grid 8Operating systems
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
Text from CVE List