Live › vulnerability › CVE-2026-92171
Go to dashboardWhen cross-site TLS is enabled, the Infinispan Operator starts the Gossip Router container with keystore and truststore passwords as plain command-line arguments. Anyone who can read pod specs in the namespace, or local processes on the node, can capture those passwords without needing access to secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running the Infinispan Operator for Red Hat Data Grid with cross-site (xsite) TLS enabled, since that is what makes the operator launch the Gossip Router with the passwords in its arguments. Clusters without xsite TLS do not run that container and are not exposed. The sources do not name a patched version.
No product ranges from the sources yet.
kubectl get pod <pod> -o yaml and look for -tls_keystore_password or -tls_truststore_password in the container args.get pods permission in the namespace.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-92171")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.