CVE-2026-80344
Camel-AS2: server-side request forgery and credential disclosure - the asynchronous MDN delivery address supplied by the remote partner was used as the destination for the receipt, so the sender chose where the Camel instance would connect and what credentials it would present
Description
In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.
Mitigation
Credit
This issue was discovered by Claude Security Scan Tool
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24417 refers to the various commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/25637 (commit ff2b608d77ba773b030fe80467e77cf28ae209d4), backported to camel-4.22.x in https://github.com/apache/camel/pull/25763 (commit af7421ff5f7456e252dad14e3279c7809cdef208) and to camel-4.18.x in https://github.com/apache/camel/pull/25764 (commit 64459b6299c07364eb9a225ee02fa2153da526e2).
The issue is classified as CWE-918 Server-Side Request Forgery (SSRF). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later.