CVE-2026-7860
Information Disclosure in Vaadin Build Plugins
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Vaadin Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vaadin | flow-plugin-base | to 23.6.10 (exc) |
| vaadin | flow-plugin-base | to 24.10.4 (exc) |
| vaadin | flow-plugin-base | to 25.1.5 (exc) |
| vaadin | flow-maven-plugin | to 23.6.10 (exc) |
| vaadin | flow-maven-plugin | to 24.10.4 (exc) |
| vaadin | flow-maven-plugin | to 25.1.5 (exc) |
| vaadin | flow-gradle-plugin | to 24.10.4 (exc) |
| vaadin | flow-gradle-plugin | to 25.1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an information disclosure issue found in certain versions of the Vaadin Maven and Gradle build plugins. When the frontend build process fails (exits with a non-zero status), the plugins expose the full set of environment variables in the build logs.
Since the build environment may contain sensitive credentials or secrets, these can be revealed in clear text within continuous integration (CI) logs and archived build artifacts, potentially exposing confidential information.
The vulnerability only triggers on failed frontend builds, which is not common during normal Vaadin application builds. Fixed versions have been released to address this issue.
How can this vulnerability impact me? :
If you use affected versions of the Vaadin Maven or Gradle plugins and experience a failed frontend build, sensitive environment variables such as credentials or secrets stored in the build environment could be exposed in build logs.
This exposure can lead to unauthorized access if attackers gain access to these logs or archived build artifacts, potentially compromising your systems or data.
The risk is limited to failed builds, but any failure could inadvertently leak secrets, making it important to upgrade to fixed versions or apply mitigations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring build logs for any failed frontend build processes that exit with a non-zero status. Specifically, you should look for exposure of environment variables in the build logs, which may include sensitive credentials or secrets.
Since the issue occurs when the frontend build fails, you can check your CI/CD pipeline logs for any build failures related to Vaadin Maven or Gradle plugins and inspect those logs for environment variable dumps.
There are no specific commands provided in the available resources, but general commands to check logs in typical CI environments or local build logs might include:
- For Unix/Linux systems, use: `grep -i 'environment' /path/to/build/logs` or `grep -i 'env' /path/to/build/logs` to find environment variable dumps.
- Check for build failures with: `grep -i 'error' /path/to/build/logs` or `grep -i 'failed' /path/to/build/logs`.
- In CI systems, review the build logs via the CI interface for any frontend build failures and inspect the logs for environment variable exposure.
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation is to upgrade the affected Vaadin Maven and Gradle plugins to fixed versions where this vulnerability has been resolved.
- Upgrade Vaadin 23.x versions to 23.6.10 or newer.
- Upgrade Vaadin 24.x versions to 24.10.4 or newer.
- Upgrade Vaadin 25.x versions to 25.1.5 or newer.
Additionally, users should avoid using unsupported Vaadin versions (10-13 and 15-22) and update to the latest supported versions in the 23, 24, or 25 series.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to the exposure of sensitive credentials or secrets in build logs when a frontend build fails. Such exposure of sensitive information may result in non-compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of confidential data and credentials.
Because the environment variables may contain secrets, their disclosure in CI logs and archived build artifacts could violate requirements for secure handling of sensitive information under these regulations.
Mitigations include upgrading to fixed versions of the Vaadin plugins to prevent this information disclosure and help maintain compliance.