CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component.
This issue affects Apache Camel: from 4.21.0 before 4.22.2.
WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of string prefixes that named the IPv6 unique local range fc00::/7, while a host reached through a name was resolved and the resulting address classified with the InetAddress predicates isLoopbackAddress, isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates do not cover the same ground as the prefix list: isSiteLocalAddress reports the deprecated fec0::/10 block and not the fc00::/7 unique local addresses that replaced it, and the JDK carries no predicate for them at all. The same address was therefore accepted or rejected depending on how it was written, and a webhook URL whose host name resolved into fc00::/7 passed a guard that refused the identical address given as a literal. PushNotificationDispatcher then sent the push notification to that address, together with any Authorization header carried in the same configuration, whose scheme and credentials the registering caller supplies. The webhook URL arrives as TaskPushNotificationConfig.url from the caller registering the push notification, so it is attacker-controlled, and allowLocalWebhookUrls is false by default, which is the configuration in which the guard is expected to hold. The response is not relayed back to the caller who registered the configuration, so what the gap yields is a blind outbound HTTPS request from the Camel process to an internal address the guard was written to refuse; reaching a service that way additionally requires that the name resolve into fc00::/7 in the target environment, that an HTTPS service be listening on that address, and that the TLS handshake succeed for the name being requested, which is why the severity is assessed medium. The same string pre-check was also wrong in the other direction: it matched the raw host string without first establishing that the host was an IP literal, so any name merely beginning with fc or fd, such as fcm.googleapis.com, was refused outright.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. The 4.21.x release line reached end of life before this issue was resolved and will not receive a fix, so deployments on it must move to a supported release. Both the literal and the resolved path now classify the address from its raw bytes with one shared classifier, which recognises fc00::/7 and the shared address space 100.64.0.0/10, as well as IPv4-compatible, NAT64 (64:ff9b::/96) and 6to4 (2002::/16) addresses whose embedded IPv4 address is not globally routable. For deployments that cannot upgrade immediately, place authentication in front of the A2A push notification configuration path so that the webhook URL does not arrive from an untrusted caller, and deny egress from the Camel process to fc00::/7 at the network level; where the deployment has no need of IPv6, starting the JVM with -Djava.net.preferIPv4Stack=true removes the address class the gap turns on. Note that allowLocalWebhookUrls=false is already the default and does not by itself close the gap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Configuration
Start the JVM with -Djava.net.preferIPv4Stack=true when the deployment has no need for IPv6.
JVM java.net.preferIPv4Stack = true - Compensating control
Place authentication in front of the A2A push notification configuration path so webhook URLs cannot be supplied by untrusted callers.
- Compensating control
Deny egress from the Camel process to the IPv6 unique local range fc00::/7 at the network level.
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Camel A2A deployments from 4.21.0 before 4.22.2 are affected when they use push notification webhooks with a host name that resolves to an IPv6 unique local address in fc00::/7.
What conditions are required for exploitation?
The webhook must be specified with a host name rather than the equivalent IPv6 literal, and that name must resolve to an address in fc00::/7. The CVSS vector indicates no attacker privileges or user interaction are required, but exploitation has high attack complexity.
What could be exposed if a vulnerable webhook is used?
The push notification dispatcher sends the notification to the resolved address. If the webhook configuration includes an Authorization header, its configured authentication scheme and credentials are sent with that request.
How can I determine whether configuration is exposed?
Review A2A push notification webhook URLs that use host names and resolve those names. URLs resolving to IPv6 addresses in fc00::/7 can bypass the guard in affected versions, whereas the same address written as an IP literal is rejected.
What should be done if immediate patching is not possible?
Avoid configuring push notification webhook host names that resolve to fc00::/7 addresses. Upgrade affected Apache Camel A2A installations to 4.22.2 when possible.