Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2026-80344: Apache Camel AS2 may contact attacker servers and leak credentials
CVE-2026-80344 · published 16 days ago
Summary
Versions of Apache Camel that include the AS2 component before the latest updates can be made to connect to any address the sender supplies. This lets a remote partner force the system to reach internal machines and reveal the password used for receipt delivery. Update to the newest Camel release (or the specified patch versions) and, if you cannot upgrade right away, limit outbound connections from the AS2 receiver to only trusted partners and avoid using shared credentials for those deliveries.
What to do
- Update apache software foundation apache camel to version 4.18.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache camel | < 4.18.5 |
| apache | camel |
>= 4.0.0, < 4.18.5 >= 4.19.0, < 4.22.1 cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* |
Original advisory text
Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
References
- https://camel.apache.org/security/CVE-2026-80344.html Mitigation Patch Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80344... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80344 Vendor Advisory
- https://repo.maven.apache.org/maven2 URL
- https://github.com/apache/camel/pull/25637 Issue Tracking Patch
- https://github.com/apache/camel/pull/25763 Issue Tracking Patch
- https://github.com/apache/camel/pull/25764 Issue Tracking Patch
- https://issues.apache.org/jira/browse/CAMEL-24417 Issue Tracking Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published19 Oct 2026
Updated4 Nov 2026
First seen19 Oct 2026
Track software like this
Free during beta