A flaw in the Infinispan Operator for Red Hat Data Grid allows its Gossip Router container to receive keystore and truststore passwords as plain-text command‑line arguments. These arguments are stored in the Pod specification, so any account with the ability to view pod details can read the passwords without needing access to secrets or node filesystems. The exposure occurs only when cross‑site TLS is enabled, but the vulnerability results in leakage of authentication material that could enable credential compromise or impersonation.

Red Hat Data Grid 8 with the Infinispan Operator. No specific operator version is cited, so all releases that deploy the Gossip Router with xsite TLS enabled are potentially affected.

The CVSS score of 6.5 indicates moderate severity. Although an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the attack can be executed by any principal that has get pods permissions in the namespace, a permission that many users or service accounts may already possess. The vulnerability requires no secret permissions or privileged node access, making it relatively easy to exploit for an attacker who can query pod specs or view logs that capture the command line.