Log in Start free

Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M

CVE-2026-34164Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

Medium 4.9

In plain English

A medium-severity sensitive data in logs in valtimo from valtimo-platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavencom.ritense.valtimo:inbox13.22.0.RELEASEGHSA-hfrg-mcvw-8mch

Affected products (as reported)

VendorProductVersions
valtimo-platform valtimo >= 13.0.0.RELEASE, < 13.22.0.RELEASE

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References