Infinispan Operator CVE-2026-92171

Cross-site (xsite) TLS must be enabled for Red Hat Data Grid - this is a non-default, operator-driven configuration, and without it the Gossip Router is not launched with the -tls_keystore_password / -tls_truststore_password arguments, so the flaw does not manifest. Given that condition, the credentials are exposed to any principal holding get pods in the namespace (notably WITHOUT needing get secrets), to any process with node-level access via /proc/<pid>/cmdline, and to anything consuming audit/event logs. The limiting factors are therefore: the xsite TLS feature must be enabled, and the attacker must already hold at least low-privilege authenticated namespace access or node/log access; it is not exploitable against an unconfigured default deployment and the leaked passwords are only useful to an attacker who can then reach the cross-site TLS endpoints.

This is a genuine but moderate-priority information-disclosure issue, not a drop-everything emergency. The vendor (Red Hat) CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects confidentiality-only impact: TLS keystore/truststore passwords are leaked, but there is no integrity or availability impact. PR:L correctly captures that an attacker needs some authenticated namespace access (specifically get pods), and the key insight is that this is a privilege-escalation-of-visibility flaw - secrets that should require get secrets become readable with only get pods. The vuln.today decision label is 'this_month', consistent with a real-but-gated issue rather than act_now/emergency. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input; this is a data gap, not evidence of low risk. There is no CISA KEV listing and no POC reference in the input, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent (medium CVSS, this_month priority, no active-exploitation indicators), so there are no conflicting signals to flag - the main caveat is the absence of EPSS and the fact that real impact depends entirely on the value of the credentials protecting the cross-site TLS keystores.

In a cluster where Red Hat Data Grid has cross-site (xsite) TLS enabled, a low-privileged tenant or compromised service account that holds only get pods in the namespace (but not get secrets) reads the Gossip Router Pod spec and recovers the -tls_keystore_password and -tls_truststore_password values in plain text. The same values are also exposed to anyone with node-level access via /proc/<pid>/cmdline and are frequently captured in audit/event logs. No public exploit identified at time of analysis; the attack requires no special tooling beyond standard Kubernetes API access.