CVE-2026-7860

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4 Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version. ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5

• CWE-209

• https://github.com/vaadin/flow/pull/24219
• https://vaadin.com/security/cve-2026-7860

Published

May 19, 2026

Last Modified

Sep 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78594Improper Handling of Highly Compressed Data (CWE-409) in APM…4.9
• CVE-2026-78595Missing Authorization in Kibana Leading to Information Discl…4.3
• CVE-2026-78596Missing Authorization in Kibana Leading to Unauthorized Modi…4.3
• CVE-2026-78597Missing Authorization (CWE-862) in the Kibana Entity Store f…4.3
• CVE-2026-78598Incorrect Authorization (CWE-863) in the Kibana machine lear…5.4
• CVE-2026-78599Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2026-78600Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes …3.5
• CVE-2026-78601Missing Authorization (CWE-862) in Kibana can lead to inform…5.5
• CVE-2026-78602Improper Limitation of a Pathname to a Restricted Directory …5.3
• CVE-2026-78603Missing Authorization (CWE-862) in Kibana can lead to inform…4.3
• CVE-2026-78604Incorrect Permission Assignment for Critical Resource (CWE-7…7.8
• CVE-2026-78605Inconsistent Interpretation of HTTP Requests ('HTTP Request …5.9