CVE-2026-80344 (GCVE-0-2026-80344)

Vulnerability from cvelistv5 – Published: 2026-10-19 10:28 – Updated: 2026-10-19 10:28
VLAI
Title
Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
Summary
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
apache CNA under the mitre root
CNA scorecard B 76/100 over 1004 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Camel Affected: 4.0.0 , < 4.18.5 (maven)
Affected: 4.19.0 , < 4.22.1 (maven)
Unaffected: 4.18.5 (maven)
Unaffected: 4.22.1 (maven)
Unaffected: 4.23.0 (maven)
guessed Create a notification for this product.
Credits
Claude Security Andrea Cosentino
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.camel:camel-as2",
          "packageURL": "pkg:maven/org.apache.camel/camel-as2",
          "product": "Apache Camel",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.18.5",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "4.22.1",
              "status": "affected",
              "version": "4.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.22.1",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.23.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claude Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andrea Cosentino"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\u003cbr\u003e\u003cbr\u003eIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment\u0027s network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.\u003cbr\u003e\u003cbr\u003eUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.\u003c/p\u003e"
            }
          ],
          "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment\u0027s network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T10:28:48.809Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "Apache Camel Security Advisory - CVE-2026-80344",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://camel.apache.org/security/CVE-2026-80344.html"
        },
        {
          "name": "CAMEL-24417",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/CAMEL-24417"
        },
        {
          "name": "Fix on main, released in 4.23.0 (commit ff2b608d77ba773b030fe80467e77cf28ae209d4)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/camel/pull/25637"
        },
        {
          "name": "Backport to camel-4.22.x, released in 4.22.1 (commit af7421ff5f7456e252dad14e3279c7809cdef208)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/camel/pull/25763"
        },
        {
          "name": "Backport to camel-4.18.x, released in 4.18.5 (commit 64459b6299c07364eb9a225ee02fa2153da526e2)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/camel/pull/25764"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.\u003c/p\u003e"
            }
          ],
          "value": "For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-80344",
    "datePublished": "2026-10-19T10:28:48.809Z",
    "dateReserved": "2026-08-26T09:43:30.068Z",
    "dateUpdated": "2026-10-19T10:28:48.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.camel:camel-as2",
                "packageURL": "pkg:maven/org.apache.camel/camel-as2",
                "product": "Apache Camel",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "4.18.5",
                    "status": "affected",
                    "version": "4.0.0",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "4.22.1",
                    "status": "affected",
                    "version": "4.19.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "4.18.5",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "4.22.1",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "4.23.0",
                    "versionType": "maven"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment\u0027s network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners."
          }
        ],
        "id": "CVE-2026-80344",
        "lastModified": "2026-10-19T11:17:21.363",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security@apache.org",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-19T11:17:21.363",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://camel.apache.org/security/CVE-2026-80344.html"
          },
          {
            "source": "security@apache.org",
            "url": "https://github.com/apache/camel/pull/25637"
          },
          {
            "source": "security@apache.org",
            "url": "https://github.com/apache/camel/pull/25763"
          },
          {
            "source": "security@apache.org",
            "url": "https://github.com/apache/camel/pull/25764"
          },
          {
            "source": "security@apache.org",
            "url": "https://issues.apache.org/jira/browse/CAMEL-24417"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security@apache.org",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-19T18:01:40+00:00",
      "cve": "CVE-2026-80344",
      "id": "CVE-2026-80344",
      "initial_release_date": "2026-10-19T10:28:48.809000+00:00",
      "product_status:known_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.