4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34164

CVE-2026-34164: Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34164

CVE-2026-34164:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.ritense.valtimo:inbox	maven	>= 13.0.0.RELEASE, < 13.22.0.RELEASE	13.22.0.RELEASE

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sensitive data exposure issue within the InboxHandlingService of the Valtimo platform. The root cause is an overly permissive logging statement in the handle function. The function, designed to process incoming inbox messages, was logging the entire message content at the INFO level. According to the vulnerability description, these messages can contain sensitive information like PII and case details. The provided patch in commit f16a1940ba7b34627c0b966f98ca78655ace9335 directly modifies this function. It changes the log statement from logger.info("Received message: {}", message) to logger.debug { "Received inbox message" }. This change both reduces the log level to DEBUG and, crucially, removes the message content from the log entry, thus mitigating the data exposure. Therefore, the com.ritense.inbox.InboxHandlingService.handle function is the exact location of the vulnerability, as it is the function that improperly logs the sensitive data.

Vulnerable functions

com.ritense.inbox.InboxHandlingService.handle

backend/inbox/src/main/kotlin/com/ritense/inbox/InboxHandlingService.kt

The `handle` function in `InboxHandlingService` was logging the entire content of incoming messages, which could contain sensitive data, at the INFO level. This exposed sensitive data in application logs. The vulnerability was fixed by changing the log level to DEBUG and removing the message payload from the log entry.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.