Medium · CVSS 6.5CVE-2026-92171

Infinispan-operator: infinispan operator: sensitive information disclosure due pod args storeCVE-2026-92171

Answer in brief

CVE-2026-92171 records a Medium severity (CVSS 6.5) vulnerability in Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store. The current sources do not mark it as known exploited. The current feed maps Red Hat/infinispan-server-core (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 26, 2026Updated Oct 26, 2026Source checked Oct 26, 2026First seen by HOL Oct 26, 2026Material review Oct 26, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.5
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/infinispan-server-core (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/infinispan-server-coregeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/infinispan-server-core.
Review the reported fix. Source-reported workaround: To mitigate this issue, restrict Role-Based Access Control (RBAC) permissions for `get pods` within the namespace where the Infinispan Operator is deployed. Grant `get pods` access only to users and service accounts that explicitly require it, thereby limiting the exposure of sensitive keystore and truststore passwords.

Evidence timeline and material changes

Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 26, 2026

Sources and claim methodology

Upstream source description

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.

Quoted source text, attributed separately from HOL analysis.