CVE-2026-92171

The record

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.

Affected packages

Related vulnerabilities

• CVE-2026-116246 To pass a server's password to psql and to the utilities pgAdmin 4 runs as background… CWE-214
• CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for… CWE-214
• CVE-2026-113495 A flaw was found in cockpit-machines. CWE-214
• CVE-2026-113496 A flaw was found in cockpit-machines. CWE-214
• CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. CWE-214
• CVE-2026-81684 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI… CWE-214
• CVE-2026-80158 A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. CWE-214
• CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of… CWE-214