{"id":"GHSA-j8mx-j73w-9mxw","summary":"Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability","details":"A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\n\n| Product version | Mitigation |\n|---|---|\n| `Vaadin 23.0.0 - 23.6.10` | `Upgrade to 23.6.11` |\n| `Vaadin 24.0.0 - 24.9.17` | `Upgrade to 24.9.18` |\n| `Vaadin 24.10.0 - 24.10.3` | `Upgrade to 24.10.4` |\n| `Vaadin 25.0.0 - 25.0.11` | `Upgrade to 25.0.12` |\n| `Vaadin 25.1.0 - 25.1.4` | `Upgrade to 25.1.5 or newer` |\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.\n\n| Maven coordinates | Vulnerable version | Fixed version |\n|---|---|---|\n| `com.vaadin:flow-plugin-base` | `23.0.0 - 23.6.10` | `≥ 23.6.11` |\n| `com.vaadin:flow-plugin-base` | `24.0.0 - 24.9.17` | `≥ 24.9.18` |\n| `com.vaadin:flow-plugin-base` | `24.0.0 - 24.10.3` | `≥ 24.10.4` |\n| `com.vaadin:flow-plugin-base` | `25.0.0 - 25.0.11` | `≥ 25.0.12` |\n| `com.vaadin:flow-plugin-base` | `25.1.0 - 25.1.4` | `≥ 25.1.5` |\n| `com.vaadin:flow-maven-plugin` | `23.0.0 - 23.6.10` | `≥ 23.6.11` |\n| `com.vaadin:flow-maven-plugin` | `24.0.0 - 24.9.17` | `≥ 24.9.18` |\n| `com.vaadin:flow-maven-plugin` | `24.0.0 - 24.10.3` | `≥ 24.10.4` |\n| `com.vaadin:flow-maven-plugin` | `25.0.0 - 25.0.11` | `≥ 25.0.12` |\n| `com.vaadin:flow-maven-plugin` | `25.1.0 - 25.1.4` | `≥ 25.1.5` |\n| `com.vaadin:flow-gradle-plugin` | `24.0.0 - 24.9.17` | `≥ 24.9.18` |\n| `com.vaadin:flow-gradle-plugin` | `24.0.0 - 24.10.3` | `≥ 24.10.4` |\n| `com.vaadin:flow-gradle-plugin` | `25.0.0 - 25.0.11` | `≥ 25.0.12` |\n| `com.vaadin:flow-gradle-plugin` | `25.1.0 - 25.1.4` | `≥ 25.1.5` |","aliases":["CVE-2026-7860"],"modified":"2026-06-04T18:56:25.675977Z","published":"2026-05-19T12:31:42Z","database_specific":{"cwe_ids":["CWE-209"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-06-04T18:38:34Z","nvd_published_at":"2026-05-19T12:16:19Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7860"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/24219"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow"},{"type":"WEB","url":"https://vaadin.com/security/cve-2026-7860"}],"affected":[{"package":{"name":"com.vaadin:flow-plugins","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-plugins"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"23.6.11"}]}],"versions":["23.0.0","23.0.1","23.0.10","23.0.11","23.0.12","23.0.13","23.0.14","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8","23.0.9","23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.2","23.1.3","23.1.4","23.1.5","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.4.2","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.10","23.6.2","23.6.3","23.6.4","23.6.5","23.6.6","23.6.7","23.6.8","23.6.9"],"database_specific":{"last_known_affected_version_range":"\u003c 23.6.10","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-plugins","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-plugins"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.9.18"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.16","24.0.17","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.19","24.1.2","24.1.20","24.1.21","24.1.22","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.22","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.2","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.16","24.5.17","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.14","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.14","24.8.15","24.8.16","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9","24.9.0","24.9.0-beta1","24.9.0-beta2","24.9.0-beta3","24.9.0-rc1","24.9.0-rc2","24.9.1","24.9.10","24.9.11","24.9.12","24.9.13","24.9.14","24.9.15","24.9.16","24.9.17","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6","24.9.7","24.9.8","24.9.9"],"database_specific":{"last_known_affected_version_range":"\u003c 24.9.17","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-plugins","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-plugins"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.10.0"},{"fixed":"24.10.4"}]}],"versions":["24.10.0","24.10.1","24.10.2","24.10.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-plugins","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-plugins"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.12"}]}],"versions":["25.0.0","25.0.1","25.0.10","25.0.11","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","25.0.7","25.0.8","25.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c 25.0.11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-plugins","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-plugins"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.1.0"},{"fixed":"25.1.5"}]}],"versions":["25.1.0","25.1.1","25.1.2","25.1.3","25.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-maven-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-maven-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"23.6.11"}]}],"versions":["23.0.0","23.0.1","23.0.10","23.0.11","23.0.12","23.0.13","23.0.14","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8","23.0.9","23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.2","23.1.3","23.1.4","23.1.5","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.4.2","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.10","23.6.2","23.6.3","23.6.4","23.6.5","23.6.6","23.6.7","23.6.8","23.6.9"],"database_specific":{"last_known_affected_version_range":"\u003c 23.6.10","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-maven-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-maven-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.9.18"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.16","24.0.17","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.19","24.1.2","24.1.20","24.1.21","24.1.22","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.22","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.2","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.16","24.5.17","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.14","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.14","24.8.15","24.8.16","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9","24.9.0","24.9.0-beta1","24.9.0-beta2","24.9.0-beta3","24.9.0-rc1","24.9.0-rc2","24.9.1","24.9.10","24.9.11","24.9.12","24.9.13","24.9.14","24.9.15","24.9.16","24.9.17","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6","24.9.7","24.9.8","24.9.9"],"database_specific":{"last_known_affected_version_range":"\u003c 24.9.17","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-maven-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-maven-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.10.0"},{"fixed":"24.10.4"}]}],"versions":["24.10.0","24.10.1","24.10.2","24.10.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-maven-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-maven-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.12"}]}],"versions":["25.0.0","25.0.1","25.0.10","25.0.11","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","25.0.7","25.0.8","25.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c 25.0.11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-maven-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-maven-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.1.0"},{"fixed":"25.1.5"}]}],"versions":["25.1.0","25.1.1","25.1.2","25.1.3","25.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-gradle-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-gradle-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.9.18"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.16","24.0.17","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.19","24.1.2","24.1.20","24.1.21","24.1.22","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.22","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.2","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.16","24.5.17","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.14","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.0.alpha10","24.8.0.alpha11","24.8.0.alpha12","24.8.0.alpha13","24.8.0.alpha14","24.8.0.alpha15","24.8.0.beta1","24.8.0.beta2","24.8.0.beta3","24.8.0.beta4","24.8.0.rc1","24.8.0.rc2","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.14","24.8.15","24.8.16","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9","24.9.0","24.9.0-alpha1","24.9.0-alpha2","24.9.0-alpha3","24.9.0-alpha4","24.9.0-alpha5","24.9.0-alpha6","24.9.0-beta1","24.9.0-beta2","24.9.0-beta3","24.9.0-rc1","24.9.0-rc2","24.9.1","24.9.10","24.9.11","24.9.12","24.9.13","24.9.14","24.9.15","24.9.16","24.9.17","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6","24.9.7","24.9.8","24.9.9"],"database_specific":{"last_known_affected_version_range":"\u003c 24.9.17","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-gradle-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-gradle-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.10.0"},{"fixed":"24.10.4"}]}],"versions":["24.10.0","24.10.1","24.10.2","24.10.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-gradle-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-gradle-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.12"}]}],"versions":["25.0.0","25.0.1","25.0.10","25.0.11","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","25.0.7","25.0.8","25.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c 25.0.11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}},{"package":{"name":"com.vaadin:flow-gradle-plugin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-gradle-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.1.0"},{"fixed":"25.1.5"}]}],"versions":["25.1.0","25.1.1","25.1.2","25.1.3","25.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green"}]}