{"id":"CVE-2026-44516","aliases":["GHSA-3jh5-rr2q-xfv7"],"url":"https://o3.security/vulnerability/CVE-2026-44516","summary":"Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer","details":"### Summary\n\nThe `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring's `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.\n\n### Impact\n\nThe logged data can contain highly sensitive information including:\n- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers\n- Personal data (BSN, email addresses, case details) in request/response bodies\n- Session tokens in `Set-Cookie` response headers\n\nThis data is exposed to:\n- Anyone with access to application logs (stdout/log files)\n- Users with access to logging aggregation tools (e.g. Grafana/Loki)\n- Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)\n\nLeaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.\n\nRelated: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)\n\n### Affected Code\n\n`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.\n\n### Patched Versions\n\nThe vulnerability is fixed in:\n- **12.33.0** (v12 release line) — see PR #600\n- **13.26.0** (v13 release line) — see PR #599\n\nThe fix removes the request/response report, headers, and response body from the `HttpClientErrorException` constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).\n\n### Mitigation\n\nIf you cannot upgrade to a patched version immediately, consider:\n- Restricting access to application logs and the Valtimo logging module\n- Adjusting the log level for `com.ritense.valtimo.web.logging` to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)","published":"2026-05-14T16:48:06.113Z","modified":"2026-08-12T03:51:13.524711908Z","cvss":{"score":7.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N"},"epss":{"score":0.002,"percentile":0.10025,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.ritense.valtimo:web","fixedVersion":"12.33.0"},{"ecosystem":"Maven","name":"com.ritense.valtimo:web","fixedVersion":"13.26.0"}],"fix":{"url":"https://github.com/valtimo-platform/valtimo/pull/599","label":"valtimo-platform/valtimo#599"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44516.json"},{"type":"ADVISORY","url":"https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-3jh5-rr2q-xfv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44516"},{"type":"WEB","url":"https://github.com/valtimo-platform/valtimo/pull/599"},{"type":"WEB","url":"https://github.com/valtimo-platform/valtimo/pull/600"},{"type":"PACKAGE","url":"https://github.com/valtimo-platform/valtimo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.524711908Z"}}