CVE-2026-80344
Received Received - Intake

Server-Side Request Forgery in Apache Camel AS2 Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-80344
EUVD
EUVD-2026-104213

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80344 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Camel's AS2 component. It allows a remote attacker to control where the server connects for Message Disposition Notification (MDN) delivery by manipulating the Receipt-Delivery-Option header in AS2 messages. The server uses this unvalidated address directly, potentially exposing internal network hosts and sending credentials to attacker-controlled destinations.

Impact Analysis

This vulnerability could allow an attacker to make your Apache Camel AS2 server connect to internal systems or unauthorized external hosts. If credentials are configured for MDN delivery, they may be sent to these attacker-chosen destinations, potentially leading to credential theft or unauthorized access to internal resources.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 for 4.18.x or 4.22.1 for 4.22.x). As a temporary measure, restrict outbound connectivity from the AS2 receiver to trusted partner endpoints and avoid attaching credentials valid for unintended hosts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart