CVE-2026-44516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44516
Aliases
Published
2026-05-14T16:48:06.113Z
Modified
2026-07-08T08:03:15.813550443Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Details

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44516.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-532"
    ]
}
References

Affected packages

Git / github.com/valtimo-platform/valtimo

Affected ranges

Type
GIT
Repo
https://github.com/valtimo-platform/valtimo
Events
Introduced
60778aca5d1d3dc8a56e73474cdf8f44bcf980ee
Fixed
611dcdb3da8dafc9e7bdc59ee4b31b1c6b803de6
Introduced
7b9abf8a46fe50f57c0b87b1e185ba60582d6741
Fixed
c9d5df08ae0957238a2c8d37ea4d4858cb9e11ba
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "12.4.0"
        },
        {
            "fixed": "12.33.0"
        },
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.26.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44516.json"