CVE-2026-44516 Details

A vulnerability in Valtimo's web module, affecting versions 12.4.0 prior to 12.33.0 and 13.0.0 prior to 13.26.0, allows for sensitive data exposure through automatic logging of outgoing HTTP requests and responses. The LoggingRestClientCustomizer intercepts these HTTP calls made via Spring's RestClient, logging the full request body, response body, and response headers. This logged information can include authentication credentials, personal data, and session tokens. When an error response is received, the data is incorporated into the HttpClientErrorException message, which is logged at ERROR level by default, regardless of the application's DEBUG log level setting.

Users can upgrade to Valtimo versions 12.33.0 or 13.26.0, where this vulnerability is patched. If an immediate upgrade is not possible, access to application logs and the Valtimo logging module should be restricted, and the log level for com.ritense.valtimo.web.logging should be adjusted to WARN or higher. Note that this adjustment only mitigates the DEBUG logging path, while error responses still leak data via the exception message.