CVE-2026-80344: CWE-918 Server-Side Request Forgery (SSRF) in Apache Software Foundation Apache Camel

The Apache Camel AS2 component suffers from an SSRF vulnerability (CWE-918) where the asynchronous MDN destination address is taken directly from the inbound message without proper constraints. This allows a remote partner to specify an arbitrary host for the Camel instance to connect to when delivering the MDN, potentially reaching internal network hosts and exposing credentials configured for MDN delivery. The vulnerability affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in Apache Camel 4.18.5, 4.22.1, and 4.23.0 by constraining the MDN destination address. Mitigation includes upgrading to these fixed versions or restricting outbound connectivity and credential usage for MDN delivery.

An attacker can exploit this SSRF vulnerability to make the Apache Camel AS2 receiver connect to arbitrary hosts, including internal network resources not normally accessible externally. The outbound connection may carry credentials configured for MDN delivery, which could be exposed to attacker-controlled destinations. This can lead to unauthorized access or information disclosure within the internal network. The CVSS score of 8.2 reflects high impact on confidentiality with limited integrity impact and no availability impact.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, 4.22.1 if using the 4.22.x LTS stream, or 4.23.0 for other users. These versions constrain the asynchronous MDN destination address to prevent SSRF. For deployments unable to upgrade immediately, restrict outbound network connectivity from the AS2 receiver to only legitimate partner endpoints and avoid attaching credentials to MDN delivery that are valid for any hosts other than those partners.