Server-Side Request Forgery (SSRF) in Apache Camel - CVE-2026-71569
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to send blind HTTPS requests to internal services and potentially disclose configured webhook authorization credentials.
The vulnerability exists due to inconsistent address validation in the camel-a2a WebhookUrlValidator when checking push notification webhook URLs containing host names rather than IP literals. A remote attacker can register a TaskPushNotificationConfig.url whose host name resolves to an IPv6 unique local address in fc00::/7 to bypass the local-address guard and cause PushNotificationDispatcher to connect to that address with any configured webhook authorization header or bearer token.
Reaching an internal service requires an HTTPS listener at the target address and a successful TLS handshake for the requested host name.