CVE-2026-7860 — Vulnerability in com.vaadin:flow-gradle-plugin —...

LOW

Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

Published May 19, 2026Updated June 4, 2026Source: osv

Summary

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: | Product version | Mitigation | |---|---| | `Vaadin 23.0.0 - 23.6.10` | `Upgrade to 23.6.11` | | `Vaadin 24.0.0 - 24.9.17` | `Upgrade to 24.9.18` | | `Vaadin 24.10.0 - 24.10.3` | `Upgrade to 24.10.4` | | `Vaadin 25.0.0 - 25.0.11` | `Upgrade to 25.0.12` | | `Vaadin 25.1.0 - 25.1.4` | `Upgrade to 25.1.5 or newer` | Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version. | Maven coordinates | Vulnerable version | Fixed version | |---|---|---| | `com.vaadin:flow-plugin-base` | `23.0.0 - 23.6.10` | `≥ 23.6.11` | | `com.vaadin:flow-plugin-base` | `24.0.0 - 24.9.17` | `≥ 24.9.18` | | `com.vaadin:flow-plugin-base` | `24.0.0 - 24.10.3` | `≥ 24.10.4` | | `com.vaadin:flow-plugin-base` | `25.0.0 - 25.0.11` | `≥ 25.0.12` | | `com.vaadin:flow-plugin-base` | `25.1.0 - 25.1.4` | `≥ 25.1.5` | | `com.vaadin:flow-maven-plugin` | `23.0.0 - 23.6.10` | `≥ 23.6.11` | | `com.vaadin:flow-maven-plugin` | `24.0.0 - 24.9.17` | `≥ 24.9.18` | | `com.vaadin:flow-maven-plugin` | `24.0.0 - 24.10.3` | `≥ 24.10.4` | | `com.vaadin:flow-maven-plugin` | `25.0.0 - 25.0.11` | `≥ 25.0.12` | | `com.vaadin:flow-maven-plugin` | `25.1.0 - 25.1.4` | `≥ 25.1.5` | | `com.vaadin:flow-gradle-plugin` | `24.0.0 - 24.9.17` | `≥ 24.9.18` | | `com.vaadin:flow-gradle-plugin` | `24.0.0 - 24.10.3` | `≥ 24.10.4` | | `com.vaadin:flow-gradle-plugin` | `25.0.0 - 25.0.11` | `≥ 25.0.12` | | `com.vaadin:flow-gradle-plugin` | `25.1.0 - 25.1.4` | `≥ 25.1.5` |

Advisory Timeline

First published May 19, 2026 (146 days ago).
Last revised June 4, 2026 — 16 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update com.vaadin:flow-gradle-plugin to 25.1.5 or later

<!-- Update pom.xml dependency version to 25.1.5 for com.vaadin:flow-gradle-plugin -->

Maven

Update com.vaadin:flow-gradle-plugin to 25.0.12 or later

<!-- Update pom.xml dependency version to 25.0.12 for com.vaadin:flow-gradle-plugin -->

Maven

Update com.vaadin:flow-maven-plugin to 24.9.18 or later

<!-- Update pom.xml dependency version to 24.9.18 for com.vaadin:flow-maven-plugin -->

Maven

Update com.vaadin:flow-plugins to 25.1.5 or later

<!-- Update pom.xml dependency version to 25.1.5 for com.vaadin:flow-plugins -->

Maven

Update com.vaadin:flow-plugins to 25.0.12 or later

<!-- Update pom.xml dependency version to 25.0.12 for com.vaadin:flow-plugins -->

Maven

Update com.vaadin:flow-maven-plugin to 25.0.12 or later

<!-- Update pom.xml dependency version to 25.0.12 for com.vaadin:flow-maven-plugin -->

Maven

Update com.vaadin:flow-maven-plugin to 24.10.4 or later

<!-- Update pom.xml dependency version to 24.10.4 for com.vaadin:flow-maven-plugin -->

Maven

Update com.vaadin:flow-maven-plugin to 25.1.5 or later

<!-- Update pom.xml dependency version to 25.1.5 for com.vaadin:flow-maven-plugin -->

Maven

Update com.vaadin:flow-maven-plugin to 23.6.11 or later

<!-- Update pom.xml dependency version to 23.6.11 for com.vaadin:flow-maven-plugin -->

Maven

Update com.vaadin:flow-plugins to 24.9.18 or later

<!-- Update pom.xml dependency version to 24.9.18 for com.vaadin:flow-plugins -->

Maven

Update com.vaadin:flow-plugins to 23.6.11 or later

<!-- Update pom.xml dependency version to 23.6.11 for com.vaadin:flow-plugins -->

Maven

Update com.vaadin:flow-gradle-plugin to 24.9.18 or later

<!-- Update pom.xml dependency version to 24.9.18 for com.vaadin:flow-gradle-plugin -->

Maven

Update com.vaadin:flow-gradle-plugin to 24.10.4 or later

<!-- Update pom.xml dependency version to 24.10.4 for com.vaadin:flow-gradle-plugin -->

Maven

Update com.vaadin:flow-plugins to 24.10.4 or later

<!-- Update pom.xml dependency version to 24.10.4 for com.vaadin:flow-plugins -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (14)

Affects 1 ecosystem: maven (3).

Package	Ecosystem	Affected	Fixed In
com.vaadin:flow-gradle-plugin	maven	25.1.0, 25.1.1, 25.1.2, 25.1.3 (+1 more)	25.1.5
com.vaadin:flow-gradle-plugin	maven	25.0.0, 25.0.1, 25.0.10, 25.0.11 (+8 more)	25.0.12
com.vaadin:flow-maven-plugin	maven	24.0.0, 24.0.1, 24.0.10, 24.0.11 (+180 more)	24.9.18
com.vaadin:flow-plugins	maven	25.1.0, 25.1.1, 25.1.2, 25.1.3 (+1 more)	25.1.5
com.vaadin:flow-plugins	maven	25.0.0, 25.0.1, 25.0.10, 25.0.11 (+8 more)	25.0.12
com.vaadin:flow-maven-plugin	maven	25.0.0, 25.0.1, 25.0.10, 25.0.11 (+8 more)	25.0.12
com.vaadin:flow-maven-plugin	maven	24.10.0, 24.10.1, 24.10.2, 24.10.3	24.10.4
com.vaadin:flow-maven-plugin	maven	25.1.0, 25.1.1, 25.1.2, 25.1.3 (+1 more)	25.1.5
com.vaadin:flow-maven-plugin	maven	23.0.0, 23.0.1, 23.0.10, 23.0.11 (+96 more)	23.6.11
com.vaadin:flow-plugins	maven	24.0.0, 24.0.1, 24.0.10, 24.0.11 (+180 more)	24.9.18
com.vaadin:flow-plugins	maven	23.0.0, 23.0.1, 23.0.10, 23.0.11 (+96 more)	23.6.11
com.vaadin:flow-gradle-plugin	maven	24.0.0, 24.0.1, 24.0.10, 24.0.11 (+198 more)	24.9.18
com.vaadin:flow-gradle-plugin	maven	24.10.0, 24.10.1, 24.10.2, 24.10.3	24.10.4
com.vaadin:flow-plugins	maven	24.10.0, 24.10.1, 24.10.2, 24.10.3	24.10.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-209
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.1 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green

References

https://nvd.nist.gov/vuln/detail/CVE-2026-7860
ADVISORY
https://github.com/vaadin/flow/pull/24219
WEB
https://github.com/vaadin/flow
PACKAGE
https://vaadin.com/security/cve-2026-7860
WEB

Frequently Asked Questions

What is CVE-2026-7860?: Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability This vulnerability has been assigned a severity rating of LOW (CVSS score: 7.1/10).
How do I check if my project is affected by CVE-2026-7860?: CVE-2026-7860 affects com.vaadin:flow-gradle-plugin, com.vaadin:flow-maven-plugin and com.vaadin:flow-plugins. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-7860 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-j8mx-j73w-9mxw

Related CVEs

CVE-2025-55754
LOW
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies