{"id":"CVE-2026-92171","aliases":["EUVD-2026-109942","GHSA-r9qh-3wp2-xc5x"],"status":"published","title":"Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/\u003cpid\u003e/cmdline`, and frequently captured in audit/event logs.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00293,"percentile":0.22174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-214"],"published":"2026-10-26T14:35:11Z","modified":"2026-11-02T17:39:17Z","products":[{"vendor":"red hat","product":"red hat data grid 8"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92171","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529806","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92171"},{"url":"https://github.com/advisories/GHSA-r9qh-3wp2-xc5x"}],"sources":{"cve":[{"id":"CVE-2026-92171","title":"Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/\u003cpid\u003e/cmdline`, and frequently captured in audit/event logs.","status":"published","published":"2026-10-26T14:35:11.009Z","modified":"2026-11-02T17:39:17.339Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-214"],"updated_at":"2026-11-02T19:02:30.097059Z"}],"euvd":[{"id":"EUVD-2026-109942","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/\u003cpid\u003e/cmdline`, and frequently captured in audit/event logs.","status":"published","published":"2026-10-26T14:35:11Z","modified":"2026-11-02T17:39:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T05:08:39.764975Z"}],"ghsa":[{"id":"GHSA-r9qh-3wp2-xc5x","title":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is...","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/\u003cpid\u003e/cmdline`, and frequently captured in audit/event logs.","status":"published","published":"2026-10-26T15:34:48Z","modified":"2026-10-26T15:34:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-214"],"updated_at":"2026-11-02T15:14:23.996006Z"}],"nvd":[{"id":"CVE-2026-92171","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/\u003cpid\u003e/cmdline`, and frequently captured in audit/event logs.","status":"published","published":"2026-10-26T15:16:45.657Z","modified":"2026-11-02T18:18:56.987Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-214"],"updated_at":"2026-11-02T20:51:42.820268Z"}]}}