CVE-2026-71569: Apache Camel SSRF in A2A webhook validator

CVE-2026-71569 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Apache Camel is an integration framework used to connect applications and services. A flaw in the A2A component's webhook URL validator allows attackers to bypass security checks and send push notifications to internal network addresses by using domain names that resolve to the IPv6 unique local address range (fc00::/7). An attacker who can register push notifications could trigger blind outbound HTTPS requests from the Camel process to internal services, potentially exposing authorization credentials.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-71569 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71569 being exploited in the wild.
How severe is CVE-2026-71569?
Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?
Apache Camel 4.21.0 to before 4.23.0 (4.21.x reached EOL; 4.22.x fixed in 4.22.2).
Is there a fix for CVE-2026-71569?
Yes: fixed in Apache Camel 4.23.0; 4.22.2 for the 4.22.x stream. Until then: Place authentication in front of the A2A push notification configuration path so that webhook URLs do not arrive from untrusted callers, and deny egress from the Camel process to fc00::/7 at the network level. Where IPv6 is not required, start the JVM with -Djava.net.preferIPv4Stack=true to disable the affected address class. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71569 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71569?
Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Apache Camel 4.23.0; 4.22.2 for the 4.22.x stream

Place authentication in front of the A2A push notification configuration path so that webhook URLs do not arrive from untrusted callers, and deny egress from the Camel process to fc00::/7 at the network level. Where IPv6 is not required, start the JVM with -Djava.net.preferIPv4Stack=true to disable the affected address class.

Technical details

The WebhookUrlValidator in Apache Camel's A2A component inconsistently classifies IPv6 addresses depending on whether they are provided as IP literals or domain names. The validator uses different code paths: IP literals are checked against a prefix list (covering fc00::/7), while resolved names are validated using JDK predicates that do not cover the same ranges. Additionally, the literal string pre-check incorrectly rejects any host name beginning with "fc" or "fd" without verifying it is actually an IP literal. An attacker-controlled webhook URL (via TaskPushNotificationConfig.url) can exploit this to bypass the local address guard when allowLocalWebhookUrls is false (the default), resulting in an SSRF to internal addresses with attacker-supplied Authorization headers.

Affected products

  • Apache Camel 4.21.0 to before 4.23.0 (4.21.x reached EOL; 4.22.x fixed in 4.22.2)

Timeline

  • 2026-10-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.