Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService (CVE-2026-34164)

Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService (CVE-2026-34164) | HOL Guard CVE

Why this deserves its current priority

CVSS is 4.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps com.ritense.valtimo:inbox (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
com.ritense.valtimo:inboxmaven	>=13.0.0.RELEASE <13.22.0.RELEASE	13.22.0.RELEASE

Recommended response

Check inventory. Check lockfiles and deployed manifests for com.ritense.valtimo:inbox.
Review the reported fix. Update com.ritense.valtimo:inbox to 13.22.0.RELEASE if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Apr 16, 2026
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Summary The `InboxHandlingService` logs the full content of every incoming inbox message at INFO level (`logger.info("Received message: {}", message)`). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details. ### Impact This data is exposed to: - Anyone with access to application logs (stdout/log files) - Any Valtimo user with the admin role, through the logging module in the Admin UI ### Affected Code `com.ritense.inbox.InboxHandlingService#handle` in the `inbox` module. ### Resolution Fixed in [13.22.0](https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0) via commit [`f16a1940ba`](https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335) (PR [#497](https://github.com/valtimo-platform/valtimo/pull/497), tracking issue [gzac-issues#653](https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653)). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output. ### Mitigation For versions before 13.22.0, consider: - Restricting access to application logs - Adjusting the log level for `com.ritense.inbox` to WARN or higher in your application configuration

Quoted source text, attributed separately from HOL analysis.