CVE-2026-71569: SSRF in Apache Camel A2A Webhook

CVE-2026-71569 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel A2A component, specifically in the WebhookUrlValidator class. The flaw allows an attacker to register a push notification webhook configuration with a URL whose hostname resolves to an IPv6 address in the fc00::/7 range (unique local addresses), bypassing security controls that should reject requests to loopback and local addresses. The A2A component then sends an HTTPS request to that address, including any Authorization headers supplied in the configuration.

The CVSS score is 4.8 (Medium) because exploitation requires specific conditions: the hostname must actually resolve to fc00::/7 in the target environment, an HTTPS service must listen on that address, and the TLS handshake must succeed for the requested hostname. The vulnerability was fixed in versions 4.22.2 (for the 4.22.x series) and 4.23.0 (current release). The 4.21.x series reached end-of-life before resolution and will not receive a patch. A public repository on GitHub declared to contain a reproducer on the same day as official disclosure, confirming the flaw's reproducibility.

For versions vulnerable before 4.22.2, upgrading to a patched version (4.22.2 or 4.23.0) is the primary solution. If immediate upgrade is not possible, implement authentication in front of the A2A configuration path so webhook URLs do not come from untrusted callers, deny network egress from the Camel process to fc00::/7 addresses, and consider starting the JVM with the -Djava.net.preferIPv4Stack=true flag if the environment does not require IPv6.

The root cause lies in inconsistent validation logic: WebhookUrlValidator performed two different classifications of the same address depending on its format (IP literal or resolved hostname), using prefix lists for IP literals but InetAddress predicates for resolved names. The isSiteLocalAddress predicates and similar do not cover the fc00::/7 range the control intended to block, and the JDK provides no native predicate for it. This logic gap was fixed in patched versions by unifying the address classification logic.