CVE-2026-34164

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.

• CWE-532

• https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653
• https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335
• https://github.com/valtimo-platform/valtimo/pull/497
• https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0
• https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34158Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34159llama.cpp is an inference of several LLM models in C/C++. Pr…9.8
• CVE-2026-34160Chamilo LMS is an open-source learning management system. In…8.6
• CVE-2026-34161Chamilo LMS is an open-source learning management system. In…5.4
• CVE-2026-34162FastGPT is an AI Agent building platform. Prior to version 4…10
• CVE-2026-34163FastGPT is an AI Agent building platform. Prior to version 4…7.7
• CVE-2026-34165go-git is an extensible git implementation library written i…5
• CVE-2026-34166LiquidJS is a Shopify / GitHub Pages compatible template eng…5.3
• CVE-2026-34167Coolify is an open-source and self-hostable tool for managin…5
• CVE-2026-34168Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34170Coolify is an open-source and self-hostable tool for managin…4.3
• CVE-2026-34171Coolify is an open-source and self-hostable tool for managin…8