CVE-2026-80344

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.

• CWE-918

• https://camel.apache.org/security/CVE-2026-80344.htmlMitigation, Patch, Vendor Advisory
• https://github.com/apache/camel/pull/25637Issue Tracking, Patch
• https://github.com/apache/camel/pull/25763Issue Tracking, Patch
• https://github.com/apache/camel/pull/25764Issue Tracking, Patch
• https://issues.apache.org/jira/browse/CAMEL-24417Issue Tracking, Patch

Published

Oct 19, 2026

Last Modified

Nov 3, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80339The Payment Plugins for Stripe WooCommerce WordPress plugin …5.3
• CVE-2026-8034A server-side request forgery (SSRF) vulnerability was ident…9.8
• CVE-2026-80340The Payment Plugins for PayPal WooCommerce WordPress plugin …5.3
• CVE-2026-80341The Payment Plugins for PayPal WooCommerce WordPress plugin …5.9
• CVE-2026-80342The Payment Plugins for PayPal WooCommerce WordPress plugin …6.5
• CVE-2026-80343Improper Handling of Case Sensitivity vulnerability in Apach…8.2
• CVE-2026-80346StarRocks performs no privilege check when a legacy synchron…7.1
• CVE-2026-80347mcp-fetch checks a fetch target against its SSRF guard witho…7.5
• CVE-2026-80348TarsWeb enforces its per-application roles by calling AuthSe…8.8
• CVE-2026-80349TarsWeb decides whether a request comes from a trusted local…9.8
• CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
• CVE-2026-80350OneUptime's webhook target check rejects private and loopbac…7.1