{"id":"CVE-2026-80344","title":"org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination (CVE-2026-80344)","summary":"A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery r…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvssSource":"vendor","cwe":"CWE-918","vendor":"Red Hat","product":"Red Hat Fuse 7","affected":["fuse 7"],"published":"2026-10-19","updated":"2026-10-21","sourceUpdated":"2026-10-21T07:59:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80344"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555494"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80344"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80344"},{"url":"https://camel.apache.org/security/CVE-2026-80344.html"},{"url":"https://github.com/apache/camel/pull/25637"},{"url":"https://github.com/apache/camel/pull/25763"},{"url":"https://github.com/apache/camel/pull/25764"},{"url":"https://issues.apache.org/jira/browse/CAMEL-24417"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"epss":0.00489,"epssPercentile":0.4188,"exploits":{"github":1,"githubRepos":["https://github.com/oscerd/CVE-2026-80344"],"checkedAt":"2026-10-27T19:14:33.341Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T18:43:34.894909Z"},"ingestedAt":"2026-10-19T12:27:23.818Z","slug":"CVE-2026-80344","body":"## Overview\n\nA flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery receipts. Because the application sends receipts to the attacker-supplied destination without validating it against allowed hosts, the server can be coerced into connecting to restricted internal network endpoints, potentially exposing configured authentication credentials.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json)\n\n**org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-21.\n\nAffected:\n\n- Red Hat Fuse 7\n\nNo fix planned:\n\n- Red Hat Fuse 7\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- --- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to constrain asynchronous MDN receipt destinations in the AS2 receiver to an approved…","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}