CVE-2026-80344 Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address

Server-Side Request Forgery SSRF vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an...

CVE-2026-80344

The camel-as2 component in Apache Camel is vulnerable to Server-Side Request Forgery (SSRF) and credential disclosure (CWE-918, CWE-200) due to an unconstrained asynchronous Message Disposition Notification (MDN) delivery. An attacker can provide a malicious Receipt-Delivery-Option address in an ...