Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-3jh5-rr2q-xfv7

HighCVSS 7.6 / 10
Published May 11, 2026·Last modified May 11, 2026
Affected Components(0)

No affected components available

Description

Summary

The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.

Impact

The logged data can contain highly sensitive information including:

  • Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
  • Personal data (BSN, email addresses, case details) in request/response bodies
  • Session tokens in Set-Cookie response headers

This data is exposed to:

  • Anyone with access to application logs (stdout/log files)
  • Users with access to logging aggregation tools (e.g. Grafana/Loki)
  • Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)

Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.

Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)

Affected Code

com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept in the web module.

Patched Versions

The vulnerability is fixed in:

  • 12.33.0 (v12 release line) — see PR #600
  • 13.26.0 (v13 release line) — see PR #599

The fix removes the request/response report, headers, and response body from the HttpClientErrorException constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).

Mitigation

If you cannot upgrade to a patched version immediately, consider:

  • Restricting access to application logs and the Valtimo logging module
  • Adjusting the log level for com.ritense.valtimo.web.logging to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)
Risk Scores
Base Score
7.6

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. No user interaction is needed for the attacker to exploit this vulnerability. The vulnerability can affect other systems as well, not just the initial system. There is a high impact on the confidentiality of the information. There is a low impact on the integrity of the data.

Threat Intelligence
7.0

Exploitation activity has been observed. Apply available patches or mitigations urgently.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities
  • CVE-2026-44516
    Alias
  • EUVD-2026-30335
    Alias

Browse More

High severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard