Key points
- CVE-2026-80344 affects Apache Camel versions prior to 4.18.5 and 4.22.1.
- The vulnerability allows remote partners to direct server requests to internal network hosts.
- Patches are available for both LTS and standard release streams.
Apache Camel versions before 4.18.5 and 4.22.1 contain a high-severity flaw that allows attackers to force the server to make unauthorized connections. The National Vulnerability Database rates CVE-2026-80344 with a CVSS score of 8.2. This server-side request forgery issue exists specifically within the AS2 component of the integration framework, impacting how message receipts are handled and delivered to external partners.
In plain English
The AS2 protocol allows message senders to specify where delivery receipts should be sent. Previously, Apache Camel accepted this address from the incoming message without checking if it was safe or allowed by the system configuration. This meant a remote partner could trick the server into sending data to any address they chose, rather than just the intended partner endpoint.
The background
By controlling the destination address for the Message Disposition Notification, an attacker could direct the Camel instance to connect to hosts inside the deployment's private network. If the system uses credentials for these outbound connections, those sensitive tokens could be presented to the attacker-controlled destination, potentially compromising internal services or leaking authentication data.
What changes now
Apache Software Foundation has released Apache Camel 4.23.0 to resolve this issue. Users on the 4.18.x LTS stream should upgrade to version 4.18.5, while those on the 4.22.x LTS stream must move to 4.22.1. The updated code now constrains the asynchronous MDN destination, ensuring it is not taken verbatim from the inbound message but is instead validated against configured settings.
Who needs to act first
Teams should prioritize updating any Camel instances that expose the AS2 component to untrusted external partners. Roll out the patch to internet-facing systems first, as they face the highest risk of exploitation. Test the upgrade in a staging environment to ensure business continuity before applying it to production. If immediate patching is impossible, restrict outbound network traffic from these servers to only known partner endpoints and remove any broad credentials from the MDN delivery configuration.
What to do and how to stay safe: Apache Camel
- Verify which versions of Apache Camel are running in your environment and compare them against the affected ranges.
- Apply the latest patch from the appropriate LTS or standard stream as soon as possible.
- If patching is delayed, configure network rules to block outbound connections from AS2 receivers to unauthorized destinations.
- Review credential scopes for MDN delivery to ensure they are limited to specific partner endpoints only.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Apache Camel are vulnerable to this SSRF flaw?
Versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 are affected by CVE-2026-80344.
Is there a confirmed fix for this vulnerability?
Yes, upgrading to Apache Camel 4.23.0, 4.18.5, or 4.22.1 resolves the issue by constraining the MDN destination.
What happens if an attacker exploits this vulnerability?
An attacker can force the server to connect to internal hosts and potentially expose credentials configured for MDN delivery.
