CVE-2026-92171
Awaiting Analysis Awaiting Analysis - Queue

Infinispan Operator Exposes TLS Keystore Passwords in Plaintext

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: redhat-SADP

Description
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-92171
EUVD
EUVD-2026-109942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Data Grid 8 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-214 A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Infinispan Operator for Red Hat Data Grid exposing TLS keystore and truststore passwords as plain text in container command-line arguments. These passwords are visible to users with get pods permission, node processes via /proc/<pid>/cmdline, and may be captured in audit logs.

Detection Guidance

Check Pod specs for plain-text keystore and truststore passwords in command-line arguments using: kubectl get pods -o yaml | grep -E 'tls_keystore_password|tls_truststore_password'. Inspect /proc/<pid>/cmdline on nodes for exposed passwords. Review audit logs for container args containing sensitive flags.

Impact Analysis

An attacker with access to the namespace or node-level processes could extract the plain-text passwords, potentially decrypting TLS traffic or gaining unauthorized access to sensitive data. This could lead to data breaches or man-in-the-middle attacks.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Exposure of TLS credentials undermines secure data transmission and storage.

Mitigation Strategies

Update the Infinispan Operator to a patched version where passwords are passed securely. Rotate all exposed keystore and truststore passwords immediately. Restrict access to Pod specs and node-level processes to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart