CVE-2026-71569

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.21.0 through 4.22.1

Description An issue in the Apache Camel A2A component allows for Server-Side Request Forgery (SSRF). The WebhookUrlValidator inconsistently classified push notification webhook hosts. Specifically, hosts provided as IP literals were checked against a prefix list for the IPv6 unique local range fc00::/7, while hosts provided as names were resolved and checked using InetAddress predicates. Because these predicates did not cover the fc00::/7 range, a webhook URL resolving to that range could bypass security guards. This allows an attacker to control the TaskPushNotificationConfig.url variable to trigger blind outbound HTTPS requests from the Camel process to internal addresses, potentially including Authorization headers. Additionally, the pre-check incorrectly blocked any hostnames starting with fc or fd, such as fcm.googleapis.com, regardless of whether they were IP literals.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.2 for those on the 4.22.x release stream. For versions 4.21.x, migrate to a supported release as this version is end of life. Place authentication in front of the A2A push notification configuration path to prevent untrusted callers from providing the webhook URL. Deny network egress from the Camel process to the fc00::/7 range. Start the JVM with -Djava.net.preferIPv4Stack=true if IPv6 is not required.