What is the CVSS score of EUVD-2026-30335?

EUVD-2026-30335 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Valtimo are affected by EUVD-2026-30335?

Valtimo's web module logging component inadvertently exposes sensitive credentials and personal data (including JWT tokens, API keys, and personal identifiers) in production error logs accessible to…. A patch is available.

How to fix or mitigate EUVD-2026-30335?

Within 24 hours: Identify all Valtimo instances running versions prior to 12.33.0 or 13.26.0 and restrict log access to essential personnel only. Within 7 days: Apply vendor-released patch to upgrade affected instances to 12.33.0 or 13.26.0 or later. Within 30 days: Implement log redaction rules to mask credentials in all HTTP error messages and conduct access review of users with production log permissions.

Valtimo EUVD-2026-30335

| CVE-2026-44516 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-05-11 https://github.com/valtimo-platform/valtimo

GHSA-3jh5-rr2q-xfv7

Java Information Disclosure Grafana

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 16:30 vuln.today

Analysis Generated

May 11, 2026 - 16:30 vuln.today

CVE Published

May 11, 2026 - 16:11 nvd

HIGH 7.6

DescriptionGitHub Advisory

Summary

The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling - regardless of the application's DEBUG log level setting.

Impact

The logged data can contain highly sensitive information including:

Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
Personal data (BSN, email addresses, case details) in request/response bodies
Session tokens in Set-Cookie response headers

This data is exposed to:

Anyone with access to application logs (stdout/log files)
Users with access to logging aggregation tools (e.g. Grafana/Loki)
Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)

Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.

Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)

Affected Code

com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept in the web module.

Patched Versions

The vulnerability is fixed in:

12.33.0 (v12 release line) - see PR #600
13.26.0 (v13 release line) - see PR #599

The fix removes the request/response report, headers, and response body from the HttpClientErrorException constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).

Mitigation

If you cannot upgrade to a patched version immediately, consider:

Restricting access to application logs and the Valtimo logging module
Adjusting the log level for com.ritense.valtimo.web.logging to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)

AnalysisAI

Sensitive credentials and personal data leak through production error logs in Valtimo's web module via LoggingRestClientCustomizer. The component intercepts all outgoing Spring RestClient HTTP calls and includes full request/response bodies and headers in HttpClientErrorException messages logged at ERROR level, exposing JWT tokens, API keys, OAuth tokens, session cookies, and personal data (BSN numbers, case details) to anyone with log access or Valtimo admin role. Vendor-released patches available for both affected release lines (12.33.0 and 13.26.0). No public exploit identified at time of analysis, but exploitation requires only privileged access to logs rather than technical exploitation of a code vulnerability.

Technical ContextAI

The vulnerability resides in com.ritense.valtimo.web.logging.LoggingRestClientCustomizer, a Spring RestClientCustomizer that intercepts all outgoing HTTP requests made via Spring's RestClient. The component logs complete request/response data, but critically, when HTTP error responses occur, it embeds full request bodies, response bodies, and response headers into the HttpClientErrorException constructor. Spring's default exception handling logs these exceptions at ERROR level regardless of DEBUG settings, bypassing the intended DEBUG-only logging control. This represents CWE-532 (Insertion of Sensitive Information into Log File), where the logging framework inadvertently becomes a data exfiltration vector. The affected packages are pkg:maven/com.ritense.valtimo:web versions 12.4.0-12.32.x and 13.0.0-13.25.x. The fix strips request/response reports, headers, and bodies from exception messages while preserving DEBUG-level detailed logging for troubleshooting.

RemediationAI

Upgrade to patched versions: 12.33.0 for v12 release line (PR #600 at https://github.com/valtimo-platform/valtimo/pull/600) or 13.26.0 for v13 release line (PR #599 at https://github.com/valtimo-platform/valtimo/pull/599). The patches remove request/response reports, headers, and response bodies from HttpClientErrorException messages, retaining only HTTP status code and status text in exceptions while preserving full DEBUG-level logging for development troubleshooting. If immediate upgrade is not feasible, implement layered compensating controls: (1) Restrict access to application logs and disable the Valtimo built-in logging module for non-superadmin users, (2) Set log level for com.ritense.valtimo.web.logging to WARN or higher via LOGGING_LEVEL_COM_RITENSE_VALTIMO_WEB_LOGGING environment variable - note this only prevents DEBUG path leakage; ERROR-level exception messages still leak data until patched, (3) Rotate potentially exposed credentials for all external APIs integrated with Valtimo (ZGW services, OAuth providers) if logs were accessible to untrusted parties, (4) Review log retention policies and purge historical logs containing sensitive data. Vendor notes related issue GHSA-hfrg-mcvw-8mch for similar exposure in InboxHandlingService.