# CVE-2026-7860: Vaadin Maven and Gradle plugins information disclosure in build logs Source: https://junglewise.ai/threats/cve-2026-7860-vaadin-maven-and-gradle-plugins-information-disclosure-in-build Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-05-19. Updated: 2026-06-04 License: CC BY 4.0 with a link back CVE-2026-7860 · Severity: medium · CVSS 4 · Published 2026-05-19 A security issue in Vaadin's build tools for Maven and Gradle can cause sensitive information to be leaked. When a frontend build fails, the software may write all system environment variables—which often include passwords, API keys, and other secrets—into publicly accessible build logs or CI/CD archives. This could allow unauthorized individuals with access to these logs to steal credentials and compromise other systems. Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Vaadin](https://junglewise.ai/threats/vendors/vaadin). ## Quick answers **Is CVE-2026-7860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7860 being exploited in the wild. **How severe is CVE-2026-7860?** Medium severity, with a CVSS score of 4, published 19 May 2026. **Which products and versions are affected?** com.vaadin:flow-gradle-plugin (Maven) ECOSYSTEM:introduced=24.0.0,fixed=24.9.18; com.vaadin:flow-maven-plugin (Maven) ECOSYSTEM:introduced=23.0.0,fixed=23.6.11; com.vaadin:flow-plugins (Maven) ECOSYSTEM:introduced=23.0.0,fixed=23.6.11; Vaadin Flow-Gradle-Plugin 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4; and 4 more. **Is there a fix for CVE-2026-7860?** Yes. com.vaadin:flow-gradle-plugin (Maven): upgrade to 24.9.18 or later; com.vaadin:flow-maven-plugin (Maven): upgrade to 23.6.11 or later; com.vaadin:flow-plugins (Maven): upgrade to 23.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-7860 attacked?** It is attacked with local access, in a software library. **Am I affected by CVE-2026-7860?** Check whether you run com.vaadin:flow-gradle-plugin (Maven), com.vaadin:flow-maven-plugin (Maven), com.vaadin:flow-plugins (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - com.vaadin:flow-gradle-plugin (Maven): upgrade to 24.9.18 or later ```sh # set com.vaadin:flow-gradle-plugin to 24.9.18 in your pom.xml or build.gradle ``` - com.vaadin:flow-maven-plugin (Maven): upgrade to 23.6.11 or later ```sh # set com.vaadin:flow-maven-plugin to 23.6.11 in your pom.xml or build.gradle ``` - com.vaadin:flow-plugins (Maven): upgrade to 23.6.11 or later ```sh # set com.vaadin:flow-plugins to 23.6.11 in your pom.xml or build.gradle ``` ## Technical details An information disclosure vulnerability (CWE-209) exists in the Vaadin Maven and Gradle plugins. The vulnerability is triggered when the frontend build process (e.g., Vite) exits with a non-zero status, causing the plugin to dump the full set of environment variables into the build logs. In CI/CD environments, these variables frequently contain sensitive secrets such as credentials, tokens, or private keys. If these logs are archived or accessible to unauthorized users, those secrets are exposed in clear text. The issue was addressed by replacing the 'zt-exec' dependency with 'java.lang.ProcessBuilder' and improving error handling. Patches are available in versions 23.6.11, 24.9.18, 24.10.4, 25.0.12, and 25.1.5. ## Affected products - Vaadin flow-maven-plugin 23.0.0 - 23.6.10, 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4 - Vaadin flow-gradle-plugin 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4 - Vaadin flow-plugin-base 23.0.0 - 23.6.10, 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4 ## Identifiers - CVE-2026-7860 - GHSA-j8mx-j73w-9mxw ## Timeline - 2026-04-30: patched: Pull request to remove zt-exec dependency merged - 2026-05-19: disclosed: Initial advisory publication - 2026-06-04: advisory: Advisory reviewed and updated ## References - [https://github.com/vaadin/flow/pull/24219](https://github.com/vaadin/flow/pull/24219) - [https://vaadin.com/security/cve-2026-7860](https://vaadin.com/security/cve-2026-7860)