A possible information disclosure vulnerability exists in the Vaadin Maven and Gradle plugins, where the full set of environment variables is written to build logs whenever the frontend build process exits with a non‑zero status. Because the build environment may contain secrets, a failed frontend build can expose those credentials in clear text in CI logs and archived artifacts. This flaw is an information exposure weakness (CWE‑209).

The issue affects Vaadin Flow plugins for versions 23.0.0 through 25.1.4. Specifically, the Vaadin Flow Plugin Base, Vaadin Flow Maven Plugin, and Vaadin Flow Gradle Plugin are vulnerable. The vulnerable ranges are 23.0.0‑23.6.9, 24.0.0‑24.10.3, and 25.0.0‑25.1.4; the problem is fixed starting at 23.6.10, 24.10.4, and 25.1.5 respectively, which are supported releases.

The CVSS score of 1.6 indicates a low severity from a technical standpoint. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating limited known commercial exploitation. The attack vector is likely internal or within continuous integration pipelines, where a build failure could inadvertently leak sensitive data to anyone with access to the logs. The flaw requires a failed frontend build to trigger the log write, so an attacker would need to cause a build failure or already have access to the logs of a failed build.