Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| valtimo-platform | valtimo | 13.0.0.RELEASE to before 13.22.0.RELEASE | 13.22.0.RELEASE | Patch available | CNA |
| — | com.ritense.valtimo:inbox (Maven) | 13.0.0.RELEASE to before 13.22.0.RELEASE | 13.22.0.RELEASE | Patch available | GHSA-hfrg-mcvw-8mch |
- valtimo Vendorvaltimo-platform Affected 13.0.0.RELEASE to before 13.22.0.RELEASE Fixed in 13.22.0.RELEASE Patch available CNA
- com.ritense.valtimo:inbox (Maven) Vendor— Affected 13.0.0.RELEASE to before 13.22.0.RELEASE Fixed in 13.22.0.RELEASE Patch available GHSA-hfrg-mcvw-8mch
Remediation
- Fix · CNA valtimo (valtimo-platform) Fixed in 13.22.0.RELEASE
- Fix · GHSA-hfrg-mcvw-8mch com.ritense.valtimo:inbox (Maven) Fixed in 13.22.0.RELEASE Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34164
- 2026-10-03 Alias added: GHSA-hfrg-mcvw-8mch
References
Other 6
- https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch
- https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653
- https://github.com/valtimo-platform/valtimo/pull/497
- https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335
- https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0
- https://github.com/valtimo-platform/valtimo
More valtimo-platform vulnerabilities
- TI-2024-23003 @valtimo/components exposes access token to form.io CVSS 3.1CRITICAL 9.8
- TI-2026-30835 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVSS 3.1CRITICAL 9.1
- TI-2025-35902 Valtimo scripting engine can be used to gain access to sensitive data or resources CVSS 3.1CRITICAL 9.1
- TI-2025-31031 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users CVSS 3.1HIGH 8.3
- TI-2026-32446 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVSS 3.1HIGH 7.6
Sources
- CVE-2026-34164 · CVE Program
- CVE-2026-34164 · NVD
- FIRST EPSS
- GHSA-hfrg-mcvw-8mch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences