Skip to content
Threat Feed
Subscribe

Tag

Valtimo

2 briefs RSS
high advisory

Valtimo Sensitive Data Exposure via Excessive HTTP Request/Response Logging (CVE-2026-44516)

The `LoggingRestClientCustomizer` in Valtimo's `web` module automatically intercepts all outgoing HTTP calls and logs the full request/response body and headers, potentially exposing sensitive information like credentials, personal data, and session tokens via error messages logged at ERROR level (CVE-2026-44516).

Valtimo sensitive-data-exposure logging
1r
critical advisory

Valtimo SpEL Injection Vulnerability Allows Remote Code Execution

Valtimo is vulnerable to SpEL injection via StandardEvaluationContext, which allows Remote Code Execution by admin users who can execute arbitrary OS commands and exfiltrate sensitive information.

Valtimo document module +2 spel-injection rce valtimo
2r 1t