CVE-2026-80344

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-80344

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80344.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-80344

Published

2026-10-19T10:28:48Z

Modified

2026-10-24T02:50:14Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address

Details

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80344.json"
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

8d135894cd73970c82da5da0dc71ecc7f5521ad5

Fixed

2a16fcefbc5e4512a80180fae12c1f0f9ca0dff0

Introduced

3e9f3011ad48de66fef582ade9794c7340c23af7

Fixed

c056bef67cdfeffdc0ad7255e5e052cab71f2921

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.18.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.19.0"
                },
                {
                    "fixed":  "4.22.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80344.json"