High, CVSS 7.6MavenPublished
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
CVE-2026-44516 · GHSA-3jh5-rr2q-xfv7
- Affected
- Maven com.ritense.valtimo:web >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0
- Fixed in
- 13.26.012.33.0· Vendor fix available
- Issue
- The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. Impact The logged data can contain highly sensitive information including: - Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers - Personal data (BSN, email addresses, case details) in request/response bodies - Session tokens in Set-Cookie response headers This data is exposed to: - Anyone with access to application logs (stdout/log files) - Users with access to logging aggregation tools (e.g. Grafana/Loki) - Any Valtimo user with the admin role, through the built-in logging module (since Valtimo…
Recommended action: Upgrade to 13.26.0 or 12.33.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.