https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:45:17.230075+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318999 EUVD-2026-318999 2026-10-06T10:45:17.232372+00:00 EUVD-2026-318999 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44516 fkie_cve-2026-44516 2026-10-06T10:45:17.232402+00:00

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.

 https://cve.radiocsirt.org/vuln/ghsa-3jh5-rr2q-xfv7 GHSA-3jh5-rr2q-xfv7 — Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer 2026-10-06T10:45:17.232438+00:00

Affected: Maven: com.ritense.valtimo:web

### Summary

The `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring's `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.

### Impact

The logged data can contain highly sensitive information including: - Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers - Personal data (BSN, email addresses, case details) in request/response bodies - Session tokens in `Set-Cookie` response headers

This data is exposed to: - Anyone with access to application logs (stdout/log files) - Users with access to logging aggregation tools (e.g. Grafana/Loki) - Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)

Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.

Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)

### Affected Code

`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.

### Patched Versions

The vulnerability is fixed in: - **12.33.0** (v12 release line…