---
id: CVE-2026-80344
title: >-
  org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via
  unvalidated receipt destination (CVE-2026-80344)
summary: >-
  A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component.
  A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a
  message that specifies an arbitrary destination address for asynchronous
  delivery r…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: vendor
cwe: CWE-918
vendor: Red Hat
product: Red Hat Fuse 7
affected:
  - fuse 7
published: '2026-10-19'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T07:59:39+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80344'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555494'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80344'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80344'
  - url: 'https://camel.apache.org/security/CVE-2026-80344.html'
  - url: 'https://github.com/apache/camel/pull/25637'
  - url: 'https://github.com/apache/camel/pull/25763'
  - url: 'https://github.com/apache/camel/pull/25764'
  - url: 'https://issues.apache.org/jira/browse/CAMEL-24417'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.00489
epssPercentile: 0.4188
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/oscerd/CVE-2026-80344'
  checkedAt: '2026-10-27T19:14:33.341Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T18:43:34.894909Z'
ingestedAt: '2026-10-19T12:27:23.818Z'
---

## Overview

A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery receipts. Because the application sends receipts to the attacker-supplied destination without validating it against allowed hosts, the server can be coerced into connecting to restricted internal network endpoints, potentially exposing configured authentication credentials.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80344.json)

**org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-21.

Affected:

- Red Hat Fuse 7

No fix planned:

- Red Hat Fuse 7

## Remediation

Affected

Workarounds / mitigations:

- --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to constrain asynchronous MDN receipt destinations in the AS2 receiver to an approved…