CVE-2026-7860: Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

Published May 19, 2026
·
Updated

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4

Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.

ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5

Affected Software

3 affected components
Vaadin Vaadin Maven plugin (com.vaadin:flow-maven-plugin)>=23.0.0<=23.6.9, >=24.0.0<=24.9.16, >=24.10.0<=24.10.3, >=25.0.0<=25.0.10, >=25.1.0<=25.1.4
Vaadin Vaadin Gradle plugin (com.vaadin:flow-gradle-plugin)>=23.0.0<=23.6.9, >=24.0.0<=24.9.16, >=24.10.0<=24.10.3, >=25.0.0<=25.0.10, >=25.1.0<=25.1.4
Vaadin Vaadin flow-plugin-base (com.vaadin:flow-plugin-base)>=23.0.0<=23.6.9, >=24.0.0<=24.9.16, >=24.10.0<=24.10.3, >=25.0.0<=25.0.10, >=25.1.0<=25.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade com.vaadin:flow-plugin-base to a version that resolves this vulnerability.

    Fixed in 23.6.11
  2. Upgrade

    Upgrade com.vaadin:flow-plugin-base to a version that resolves this vulnerability.

    Fixed in 24.9.18
  3. Upgrade

    Upgrade com.vaadin:flow-plugin-base to a version that resolves this vulnerability.

    Fixed in 24.10.4
  4. Upgrade

    Upgrade com.vaadin:flow-plugin-base to a version that resolves this vulnerability.

    Fixed in 25.0.12
  5. Upgrade

    Upgrade com.vaadin:flow-plugin-base to a version that resolves this vulnerability.

    Fixed in 25.1.5
  6. Upgrade

    Upgrade com.vaadin:flow-maven-plugin to a version that resolves this vulnerability.

    Fixed in 23.6.11
  7. Upgrade

    Upgrade com.vaadin:flow-maven-plugin to a version that resolves this vulnerability.

    Fixed in 24.9.18
  8. Upgrade

    Upgrade com.vaadin:flow-maven-plugin to a version that resolves this vulnerability.

    Fixed in 24.10.4
  9. Upgrade

    Upgrade com.vaadin:flow-maven-plugin to a version that resolves this vulnerability.

    Fixed in 25.0.12
  10. Upgrade

    Upgrade com.vaadin:flow-maven-plugin to a version that resolves this vulnerability.

    Fixed in 25.1.5
  11. Upgrade

    Upgrade com.vaadin:flow-gradle-plugin to a version that resolves this vulnerability.

    Fixed in 23.6.11
  12. Upgrade

    Upgrade com.vaadin:flow-gradle-plugin to a version that resolves this vulnerability.

    Fixed in 24.9.18
  13. Upgrade

    Upgrade com.vaadin:flow-gradle-plugin to a version that resolves this vulnerability.

    Fixed in 24.10.4
  14. Upgrade

    Upgrade com.vaadin:flow-gradle-plugin to a version that resolves this vulnerability.

    Fixed in 25.0.12
  15. Upgrade

    Upgrade com.vaadin:flow-gradle-plugin to a version that resolves this vulnerability.

    Fixed in 25.1.5

Event History

May 19, 2026
CVE Published
via MITRE·11:01 AM
Data Sourced
via MITRE·11:01 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Dec 30, 58366
Event
via FIRST·10:52 PM

Frequently Asked Questions

1

What is the severity of CVE-2026-7860?

CVE-2026-7860 is classified as a potential information disclosure vulnerability, exposing sensitive environment variables.

2

How do I fix CVE-2026-7860?

To mitigate CVE-2026-7860, update the Vaadin Maven plugin or Gradle plugin to the latest patched versions.

3

What versions are affected by CVE-2026-7860?

CVE-2026-7860 affects Vaadin Maven and Gradle plugins in versions from 23.0.0 to 23.6.10, 24.0.0 to 24.10.3, and 25.0.0 to 25.1.4.

4

What software is impacted by CVE-2026-7860?

CVE-2026-7860 impacts the Vaadin Flow Maven plugin, Flow Gradle plugin, and Flow Plugin Base.

5

What could be the consequences of CVE-2026-7860?

The consequence of CVE-2026-7860 is potential exposure of sensitive information, which can lead to further security risks.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203