CVE-2026-44516

High

Description

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.

SeverityHigh

CVSS7.6

Exploit probability10. percentile0.2%

ProductCom.ritense.valtimo:web

PublishedMay 14, 2026

First seenMay 14, 2026

Weakness typeCWE-532CWE-532

How to fix

Update

com.ritense.valtimo:web12.33.0, 13.26.0 or later

Affected products

Product	Affected versions	Fixed in
com.ritense.valtimo:webMaven	12.4.0 ≤ v < 12.33.0, 13.0.0 ≤ v < 13.26.0	12.33.0, 13.26.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.