CVE-2025-5731

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

An information exposure vulnerability (CVE-2025-5731) has been identified in the Infinispan command-line client, infinispan-cli-client, which allows a local user who can read the CLI's error output to obtain a server password decoded from a Kubernetes secret. The client is the command-line tool used to administer Infinispan Server; applications that only embed Infinispan or use the Hot Rod client do not normally ship it.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Infinispan.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-cli-client
• Affected versions: <15.0.17.Final, >=15.1.0.Dev01 <15.2.5.Final, =16.0.0.Dev01
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-cli-client
• Package manager: Maven
• Fixed in:
  • OSS Infinispan 15.0.17.Final, 15.2.5.Final, 16.0.0
  • NES for Infinispan v13.0.24 (13.0.22-infinispan-13.0.24)

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan:infinispan-cli-client package in multiple versions of Infinispan. CliRuntimeRunner.execute() joins the command name and every command-line argument into a single command string and passes it to the CLI runtime. When the runtime cannot find the command, the error handler prints that entire string to standard error:

StringBuilder sb = new StringBuilder(commandName);
if (args.length > 0) {
   sb.append(" ");
   if (args.length == 1) {
      sb.append(args[0]);
   } else {
      for (String arg : args) {
         if (arg.indexOf(' ') >= 0) {
            sb.append('"').append(arg).append("\" ");
         } else {
            sb.append(arg).append(' ');
         }
      }
   }
}
try {
   runtime.executeCommand(sb.toString());
   return ExitCodeResultHandler.exitCode;
} catch (CommandNotFoundException e) {
   System.err.println("Command not found: " + sb);
   return 1;
}

The Kubernetes shell command builds its arguments from cluster secrets. It Base64-decodes the TLS keystore password from the certificate secret and passes it as the -s option, and it decodes the user credentials from the endpoint secret's identities.yaml and embeds them as user:password@ in the -c connection URL. It then starts the CLI with those arguments, so they flow through CliRuntimeRunner. If the command line is not recognized, the plaintext password is written to standard error in the "Command not found" message, where it can end up in terminal scrollback, shell or CI logs, or any log collector that captures the process output. The same applies to any password passed on the command line of a normal cli invocation.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.