SB2026102308 - Server-Side Request Forgery (SSRF) in Apache Camel

Description

This security bulletin contains information about 1 vulnerability.

1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-71569)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to send blind HTTPS requests to internal services and potentially disclose configured webhook authorization credentials.

The vulnerability exists due to inconsistent address validation in the camel-a2a WebhookUrlValidator when checking push notification webhook URLs containing host names rather than IP literals. A remote attacker can register a TaskPushNotificationConfig.url whose host name resolves to an IPv6 unique local address in fc00::/7 to bypass the local-address guard and cause PushNotificationDispatcher to connect to that address with any configured webhook authorization header or bearer token.

Reaching an internal service requires an HTTPS listener at the target address and a successful TLS handshake for the requested host name.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=59lxzt2jd56kbgzt028y7b2gy6z561qc
• https://camel.apache.org/security/CVE-2026-71569.html