---
id: CVE-2026-92171
title: >-
  Infinispan-operator: infinispan operator: sensitive information disclosure due
  pod args store
summary: >-
  A flaw was found in the Infinispan Operator for Red Hat Data Grid. When
  cross-site (xsite) TLS is enabled, the operator launches the Gossip Router
  container with keystore and truststore passwords passed as plain-text
  command-line argumen…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-214
vendor: Red Hat
product: infinispan-server-core
affected:
  - infinispan-server-core (all versions)
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:35:11.009Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92171'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92171'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2529806'
    label: RHBZ#2529806
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.520Z'
---

## Overview

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.

## Affected

- `infinispan-server-core (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, restrict Role-Based Access Control (RBAC) permissions for `get pods` within the namespace where the Infinispan Operator is deployed. Grant `get pods` access only to users and service accounts that explicitly require it, thereby limiting the exposure of sensitive keystore and truststore passwords.