CVE-2026-92171
Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
- Record
CVE-2026-92171- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-214
- Updated
- 2026-11-02
EUVDEUVD-2026-109942
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
- Record
EUVD-2026-109942- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r9qh-3wp2-xc5x
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is...
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
- Record
GHSA-r9qh-3wp2-xc5x- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-214
- Updated
- 2026-11-02
NVD
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
- Record
CVE-2026-92171- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-214
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92171 is a medium vulnerability (CVSS 6.5) in Red Hat Data Grid 8, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. No source names a fixed version.