A possible information disclosure vulnerability exists in Vaadin’s Maven and Gradle plugins. The plugins expose the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text within CI logs and archived artifacts. This flaw represents an information exposure weakness (CWE-209).

The issue affects Vaadin Flow through the Vaadin Flow Plugin Base, Vaadin Flow Maven Plugin, and Vaadin Flow Gradle Plugin. The vulnerable ranges are 23.0.0-23.6.9, 24.0.0-24.10.3, and 25.0.0-25.1.4; the problem is fixed starting at 23.6.10, 24.10.4, and 25.1.5 respectively, which are supported releases.

The CVSS score of 1.6 indicates a low severity from a technical standpoint. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating limited known commercial exploitation. The attack vector is likely internal or within continuous integration pipelines, where a failed frontend build can expose environment variables in clear text within CI logs and archived artifacts. The flaw requires a failed frontend build to trigger the log write, so an attacker would need to cause a build failure or already have access to the logs of a failed build.