CVE-2025-5731 Infinispan: credential leakage in infinispan cli
Attackers can view sensitive Kubernetes secret passwords in plaintext via error messages when executing invalid commands in the Infinispan CLI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5731?
CVE-2025-5731 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 26 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
Weakness: CWE-209
Which versions are affected by CVE-2025-5731?
2 open source packages ship an affected version, including org.infinispan:infinispan-cli-client. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.infinispan:infinispan-cli-client Maven | All versions to 16.0.0.Dev01 | None |
org.infinispan:infinispan-cli-client Maven | All versions to 16.0.0.Dev01 | None |
Products include Infinispan Infinispan, Redhat Data Grid, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack.
How do I fix CVE-2025-5731?
No fix has been published for CVE-2025-5731 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-5731 being exploited?
There is no known exploitation of CVE-2025-5731 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2018-1131 Deserialization of Untrusted Data in Infinispan
- CVE-2017-15089 Deserialization of Untrusted Data in Infinispan
- CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan
- CVE-2023-5384 Infinispan: credentials returned from configuration as clear text
- CVE-2023-3628 Infispan: rest bulk ops don't check permissions
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-cqm8-rg2p-jfcf.