Executive brief
Valtimo is an open-source platform used by organizations to automate business processes and manage cases. A security flaw in its web module causes the system to automatically record sensitive information—including passwords, API keys, and personal data—into system logs whenever an external connection error occurs. This could allow anyone with access to the logs or the administrative dashboard to steal credentials and impersonate the system to access other connected services.
Technical details
The vulnerability exists in the LoggingRestClientCustomizer within the Valtimo web module. The component intercepts outgoing HTTP calls via Spring's RestClient and includes the full request body, response body, and headers in the HttpClientErrorException message when an error occurs. These exceptions are logged at the ERROR level by default, bypassing DEBUG level restrictions. This results in the exposure of JWT tokens, API keys, and personal data (PII) to log files, log aggregation tools, and the Valtimo admin logging module. Attackers with administrative or log access can use these leaked credentials to move laterally to external services. The issue is resolved in versions 12.33.0 and 13.26.0 by removing sensitive data from the exception constructor.
Affected products
- Valtimo Valtimo web module >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0
Timeline
- 2026-05-08: advisory: GitHub advisory published by maintainers
- 2026-05-14: disclosed: CVE published to NVD