A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (-tls_keystore_password, -tls_truststore_password). Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace (no get secrets required), to node-level processes via /proc/<pid>/cmdline, and frequently captured in audit/event logs.
To mitigate this issue, restrict Role-Based Access Control (RBAC) permissions for get pods within the namespace where the Infinispan Operator is deployed. Grant get pods access only to users and service accounts that explicitly require it, thereby limiting the exposure of sensitive keystore and truststore passwords.