CVE-2026-80344High· 8.2▾ MidnightPoC availableA flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery r…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.4%
0.4% → 0.5%
1 GitHub repo (last check)
A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery receipts. Because the application sends receipts to the attacker-supplied destination without validating it against allowed hosts, the server can be coerced into connecting to restricted internal network endpoints, potentially exposing configured authentication credentials.
org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-21.
Affected:
No fix planned:
Affected
Workarounds / mitigations:
The highest-value action is to constrain asynchronous MDN receipt destinations in the AS2 receiver to an approved…
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116176High· 8.2vllm: vllm: Information disclosure via SSRF in X-Request-Id header (CVE-2026-116176)
CVE-2026-116192Medium· 5.9github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve (CVE-2026-116192)
CVE-2026-17557Medium· 6.5Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
CVE-2026-92287Medium· 4.7arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in Parquet files (CVE-2026-92287)
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)