CVE-2025-5731: medium-severity vulnerability in Red Hat infinispan
Infinispan: credential leakage in infinispan cli
Published · Updated
Follow this CVE+ Monitor Red Hat JBoss Enterprise Application Platform Expansion Pack+ Monitor Red Hat JBoss Enterprise Application Platform
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.2%
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Red Hat · infinispanRed Hat · Red Hat Data Grid 8.5.4Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRelated CVEs — Red Hat infinispan
In the same product, most dangerous first.
CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-76166MEDIUMModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2025-9784HIGHUndertow: undertow madeyoureset http/2 ddos vulnerabilityEPSS 2.3%