Vaadin Flow EUVD-2026-30891

All of the following conditions must be simultaneously true for exploitation: (1) the target project must use an affected Vaadin Flow Maven or Gradle plugin version (23.0.0-23.6.9, 24.0.0-24.10.3, or 25.0.0-25.1.4); (2) the CI/CD build environment must inject sensitive credentials as process-level environment variables - this is common but not universal; (3) a frontend build must actually exit with a non-zero status code during a CI run, meaning a build failure must be triggered; and (4) the attacker must have read access to the resulting CI build logs or archived build artifacts, requiring at minimum low-privilege access to the CI/CD system (PR:L). The CVSS AT:P (Partial attack target) metric further qualifies that not every instance meeting these conditions will necessarily expose sensitive secrets - some environments may not inject credentials as env vars at all. The PR:N unauthenticated attack vector does NOT apply here; the CVSS vector confirms PR:L. Exploitation is not automatable (AU:N). Exploitation is limited to the local CI/CD system boundary (AV:L) and requires a build failure event to occur.

The CVSS 4.0 composite score of 1.6 is misleadingly low relative to the potential blast radius. The low score is driven by restrictive attack conditions: local access to CI infrastructure (AV:L), high attack complexity (AC:H), partial attack target (AT:P), low privileges required (PR:L), and passive user interaction (UI:P). However, the confidentiality and integrity impact on subsequent systems is rated High (SC:H/SI:H), reflecting that leaked credentials can cascade into supply chain compromise of downstream environments. EPSS data was not provided in the available inputs and cannot be inferred. The vulnerability is not in CISA KEV, and exploitation is rated Unreported (E:U) in the CVSS 4.0 supplemental metrics. SSVC automatable is No (AU:N), indicating this does not lend itself to mass automated exploitation. The CVSS urgency rating is Green (U:Green) with low remediation effort (RE:L). Despite the low score, organizations injecting secrets as environment variables in CI pipelines should treat this as a meaningful supply chain risk - the gap between CVSS score and realistic downstream impact is a known limitation of scoring credential-leakage vulnerabilities.

A developer triggers a Vaadin frontend build in a CI pipeline where secrets (for example, a container registry password or a cloud provider API key) are injected as environment variables. The frontend build fails - due to a transient npm registry timeout or a dependency resolution error - causing the affected plugin to write the full process environment, including all injected secrets, to the CI job log. An attacker or malicious insider with read access to that CI system retrieves the plaintext credentials from the log, then uses them to push malicious container images or access cloud resources, achieving supply chain compromise.