7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44516

CVE-2026-44516: Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44516

CVE-2026-44516:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.ritense.valtimo:web	maven	>= 12.4.0, < 12.33.0	12.33.0
com.ritense.valtimo:web	maven	>= 13.0.0, < 13.26.0	13.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the com.ritense.valtimo.web.logging.LoggingRestClientCustomizer.intercept function. The analysis of the provided git commits, specifically commit 827a45bc332e1542b6a0590c0b2876cd19d502bd and 81e6900bbb7f279577f004a2f24ebba856072d0a, reveals the exact nature of the vulnerability and the fix. Before the patch, the intercept function would catch HTTP errors and throw a new HttpClientErrorException that included the full request and response details, including headers and body. This behavior inadvertently logged sensitive information. The patch modifies the intercept function to only include the HTTP status code and status text in the thrown exception, while the detailed report is only logged at the DEBUG level. This prevents the leakage of sensitive data in production environments where the log level is typically higher than DEBUG.

Vulnerable functions

com.ritense.valtimo.web.logging.LoggingRestClientCustomizer.intercept

backend/web/src/main/kotlin/com/ritense/valtimo/web/logging/LoggingRestClientCustomizer.kt

The `intercept` function in `LoggingRestClientCustomizer` was vulnerable to sensitive data exposure. When an HTTP client error occurred, the function would create a detailed report including the request body, response body, and headers. This report, which could contain sensitive information like authentication tokens or personal data, was then included in the `HttpClientErrorException`. This exception was logged at the ERROR level, exposing the sensitive data in application logs regardless of the configured log level.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.