CVE Feed

    Dashboard / CVE / CVE-2026-92171

    CVE-2026-92171

    A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.

    Published:Oct 26, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 26, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Redhat
    Product
    Data Grid
    Vendor
    Redhat
    Product
    Jboss Data Grid

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-16102 (CVSS 8.1) — A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access manage…
    CVE-2026-15573 (CVSS 8.1) — A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to…
    CVE-2026-16105 (CVSS 4.9) — A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-bas…
    CVE-2026-18570 (CVSS 5.4) — A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. Thi…
    CVE-2026-18571 (CVSS 6.6) — A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) i…
    CVE-2026-18572 (CVSS 6.5) — Keycloak provides authorization services that allow administrators to restrict access to resources based on ti…
    CVE-2026-18201 (CVSS 5.5) — Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw …
    CVE-2026-18203 (CVSS 6.5) — A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution.…
    CVE-2026-18206 (CVSS 3.7) — A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management…
    CVE-2026-18207 (CVSS 6.5) — A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system chec…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High