Apache Camel AS2 EUVD-2026-104213

Requires a deployed Apache Camel AS2 receiver (camel-as2) that accepts inbound AS2 messages and processes asynchronous MDN requests; the attacker sets the async MDN return address in the inbound message and Camel uses it verbatim as the outbound destination. Full confidentiality impact (credential disclosure) additionally requires MDN-delivery credentials to be configured (mdnUserName/mdnPassword/mdnAccessToken); without them the impact is limited to SSRF and internal network reachability. Limiting factors: the attacker must be able to deliver an AS2 message to the receiver and reach its endpoint, and the outbound SSRF target is reachable only from the Camel instance's network position. Signature verification is not a barrier to the SSRF itself.

This is a credible, upgrade-worthy issue rather than a high-CVSS-but-low-risk artifact, but its real-world urgency is moderated by deployment specifics. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a remote, low-complexity, unauthenticated SSRF with high confidentiality impact - the impact being that MDN-delivery credentials and internal-only hosts are exposed to an attacker-chosen destination (CWE-918). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so this is no public exploit identified at time of analysis; the signals therefore do not point to active or widespread exploitation. The PR:N rating is consistent with AS2 receivers that accept inbound partner messages without protocol-level authentication, but note the CVSS vector implies any remote sender can trigger it while the description frames the actor as 'a remote partner' - in practice exploitability depends on whether the receiver accepts messages from the attacker and whether async MDN with credentials is configured. The highest concrete harm (credential theft) is conditional on mdnUserName/mdnPassword/mdnAccessToken being set, so environments without MDN-delivery credentials face SSRF/internal-reachability impact only.

An attacker who can send an AS2 message to a vulnerable Camel receiver requests an asynchronous Message Disposition Notification and supplies a return address pointing at an internal service (e.g. a cloud metadata endpoint or an internal admin host). Camel connects outbound to that attacker-chosen destination to deliver the MDN, and if MDN-delivery credentials are configured it presents them to the attacker's host. No public exploit code was identified, but the attack is low-complexity and requires no authentication per the CVSS vector.