Valtimo CVE-2026-44516

Requires existing privileged access to one of three exposure paths: (1) filesystem or stdout access to application logs where Valtimo is deployed, (2) authenticated access to log aggregation tools (Grafana/Loki or similar) ingesting Valtimo logs, or (3) Valtimo admin role to access the built-in logging module (available since version 12.5.0). The vulnerability is triggered passively whenever Valtimo makes outgoing HTTP requests that receive error responses (4xx/5xx status codes) - no attacker interaction with Valtimo itself is required to populate logs with sensitive data. Default Spring Boot exception handling at ERROR level means production deployments leak data even with DEBUG logging disabled. The 'Changed Scope' in CVSS reflects that leaked credentials allow subsequent attacks against external APIs, not Valtimo itself. Limiting factors: attacker needs pre-existing privileged access to logs (not a remote unauthenticated attack) and only data from error responses is logged (successful API calls logged at DEBUG only).

CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) indicates network-accessible vulnerability requiring high privileges with scope change and high confidentiality impact. However, this is NOT a remote code execution or authentication bypass - it is an information disclosure requiring existing privileged access to logs. Real-world risk depends heavily on deployment: organizations using centralized logging (Grafana/Loki mentioned in description) or granting admin role liberally face higher exposure. The 'Scope Changed' metric reflects that leaked credentials for external APIs (ZGW services specifically mentioned) allow attackers to pivot beyond Valtimo's security boundary. No EPSS score provided in input data. No CISA KEV listing - this is not being actively exploited in the wild. No public POC exists; exploitation is passive (credential harvesting from logs) rather than active attack. Primary risk is long-term credential exposure in log retention systems, particularly in multi-tenant environments or regulated sectors handling Dutch BSN numbers (social security). Mitigation difficulty: changing log levels only partially mitigates (ERROR path still leaks), making upgrade the only complete fix.

An attacker with Valtimo admin role access or read access to centralized logging infrastructure (Grafana/Loki) reviews ERROR-level logs for failed external API calls. When Valtimo's RestClient encounters HTTP error responses from integrated services (e.g., ZGW document management APIs), the full request bodies containing OAuth tokens and response headers with Set-Cookie session tokens are logged. The attacker extracts these credentials and uses them to impersonate the Valtimo application against the external API, bypassing that service's authentication and accessing citizen case data or government documents. If logs are retained long-term, the attacker can harvest credentials over time to build persistent access to external systems.