{"id":"CVE-2026-92171","kind":"vulnerability","aliases":["CVE-2026-92171"],"related":[],"title":"Infinispan Operator: xsite TLS passwords exposed in Gossip Router pod arguments","description":"A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.","summary":"When cross-site TLS is enabled, the Infinispan Operator starts the Gossip Router container with keystore and truststore passwords as plain command-line arguments. Anyone who can read pod specs in the namespace, or local processes on the node, can capture those passwords without needing access to secrets.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infinispan","infrastructure","kubernetes","openshift","red-hat-data-grid"],"not_affected_if":["no-cross-site-replication","xsite-tls-disabled"],"how_to_check":"- Check whether cross-site TLS is enabled in the Infinispan custom resources (look for xsite TLS settings in the Infinispan spec).\n- Inspect the Gossip Router pod with `kubectl get pod <pod> -o yaml` and look for `-tls_keystore_password` or `-tls_truststore_password` in the container args.\n- Review who holds `get pods` permission in the namespace.","fix":null,"status":"open","published_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:50+00:00","updated_at":"2026-10-26T16:03:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:03:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Infinispan Operator: xsite TLS passwords exposed in Gossip Router pod arguments","impact":"medium","summary":"When cross-site TLS is enabled, the Infinispan Operator starts the Gossip Router container with keystore and truststore passwords as plain command-line arguments. Anyone who can read pod specs in the namespace, or local processes on the node, can capture those passwords without needing access to secrets.","category":"infrastructure","nicknames":[],"who_cares":["infinispan","kubernetes","openshift","red-hat-data-grid"],"confidence":0.6,"needs_auth":"yes","worst_case":"Readers of pod specs or node processes obtain keystore and truststore passwords","analyst_note":"Sources do not name the fixed Infinispan Operator version or a workaround; check the Red Hat advisory for CVE-2026-92171 and the operator release notes.","how_to_check":"- Check whether cross-site TLS is enabled in the Infinispan custom resources (look for xsite TLS settings in the Infinispan spec).\n- Inspect the Gossip Router pod with `kubectl get pod <pod> -o yaml` and look for `-tls_keystore_password` or `-tls_truststore_password` in the container args.\n- Review who holds `get pods` permission in the namespace.","needs_analyst":true,"not_affected_if":["xsite-tls-disabled","no-cross-site-replication"],"who_is_affected":"Teams running the Infinispan Operator for Red Hat Data Grid with cross-site (xsite) TLS enabled, since that is what makes the operator launch the Gossip Router with the passwords in its arguments. Clusters without xsite TLS do not run that container and are not exposed. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3395,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92171':14A,17A '/cmdline':156C '/proc':155C 'access':74B 'anyon':53B 'arg':126C 'argument':11A,52B,118C 'audit/event':161C 'captur':69B,159C 'command':50B,116C 'command-lin':49B,115C 'contain':41B,104C,125C 'cross':29B,92C 'cross-sit':28B,91C 'cve':12A,15A 'data':25B,88C 'enabl':33B,97C 'expos':6A 'flaw':78C 'found':80C 'frequent':158C 'get':139C,146C 'gossip':8A,39B,102C 'grid':26B,89C 'hat':24B,87C 'infinispan':1A,18B,35B,83C 'infrastructur':19B 'keystor':43B,106C,120C 'kubernet':20B 'launch':100C 'level':152C 'line':51B,117C 'local':63B 'log':162C 'namespac':61B,144C 'need':73B 'node':67B,151C 'node-level':150C 'openshift':21B 'oper':2A,36B,84C,99C 'pass':110C 'password':5A,46B,71B,109C,121C,124C 'permiss':141C 'plain':48B,113C 'plain-text':112C 'pod':10A,57B,131C,140C 'princip':137C 'process':64B,153C 'read':56B 'red':23B,86C 'red-hat-data-grid':22B 'requir':148C 'router':9A,40B,103C 'secret':76B,147C 'site':30B,93C 'spec':58B,132C 'start':37B 'store':128C 'text':114C 'tls':4A,31B,95C,119C,122C 'truststor':45B,108C,123C 'via':154C 'visibl':134C 'without':72B 'xsite':3A,94C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Infinispan Operator for Red Hat Data Grid with cross-site (xsite) TLS enabled, since that is what makes the operator launch the Gossip Router with the passwords in its arguments. Clusters without xsite TLS do not run that container and are not exposed. The sources do not name a patched version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92171","severity":null,"published_at":"2026-10-26T15:16:45+00:00","modified_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}