Server-Side Request Forgery (SSRF) in Apache Camel - CVE-2026-80344
Published: October 23, 2026
Vulnerability identifier: #VU157291
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80344
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to induce server-side requests to arbitrary destinations, including internal network hosts, and disclose credentials configured for asynchronous receipt delivery.
The vulnerability exists due to insufficient validation of the asynchronous Message Disposition Notification (MDN) delivery address in the Apache Camel AS2 component when processing inbound AS2 messages. A remote attacker can supply an attacker-controlled delivery address to cause the AS2 receiver to send an outgoing receipt to an arbitrary host, including hosts reachable only within the deployment's network, and expose MDN delivery credentials if the outbound connection carries them.
Affected software
Apache Camel
How to mitigate CVE-2026-80344
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1