CVE-2026-44516
Last modified
CVE-2026-44516 is a high-severity vulnerability rated 7.6/10 on the CVSS scale. Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-44516?
How severe is CVE-2026-44516?
How do I fix CVE-2026-44516?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44510Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-44511Katalyst Koi is a framework for building Rails admin functio…7.4
- CVE-2026-44512Open Neural Network Exchange (ONNX) is an open standard for …5.5
- CVE-2026-44513Diffusers is the a library for pretrained diffusion models.…8.8
- CVE-2026-44514Kubetail is a real-time logging dashboard for Kubernetes. Pr…6.5
- CVE-2026-44515Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-b…2.3
- CVE-2026-44518liboqs is a C-language cryptographic library that provides i…5.3
- CVE-2026-4452Integer overflow in ANGLE in Google Chrome on Windows prior …8.8
- CVE-2026-44520Docling-Graph turns documents into validated Pydantic object…5.7
- CVE-2026-44521elFinder is an open-source file manager for web, written in …8.8
- CVE-2026-44522Note Mark is an open-source note-taking application. From 0.…8.6
- CVE-2026-44523Note Mark is an open-source note-taking application. Prior t…10
Are you affected by CVE-2026-44516?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST