Apache Camel 4.22.2 Fixes A2A Webhook SSRF
Tech GuruQuick Answer
Apache Camel CVE-2026-71569 affects A2A push notification webhooks from 4.21.0 before 4.22.2. Inventory A2A deployments and registration trust, upgrade to 4.22.2 or 4.23.0, restrict internal egress while pending, validate notifications, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Camel A2A deployments, exact versions, push notification configuration paths, webhook registrants, DNS behavior, IPv6 routing, Authorization headers, owners, and maintenance windows. Confirm that an untrusted caller can influence TaskPushNotificationConfig.url and that internal IPv6 unique-local HTTPS services are reachable; do not infer exposure from Camel use alone. Upgrade to Camel 4.22.2 or 4.23.0 and later. Until then, authenticate configuration paths and deny Camel process egress to fc00::/7 as Apache recommends. Confirm the resolved dependency and runtime version, test permitted webhooks, verify internal ranges are rejected for literal and DNS names, review outbound requests where warranted, and retain evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache Camel A2A push notification webhook validation |
|---|---|
| Advisory | Apache Camel CVE-2026-71569 |
| CVE | CVE-2026-71569 |
| Authoritative release date | 2026-10-29 10:31:01.478 UTC |
| Authority revision date | 2026-10-29 12:30:01.264 UTC |
| Affected versions | Apache Camel 4.21.0 through releases before 4.22.2 when an untrusted caller can register a push webhook resolving to IPv6 unique-local space; 4.21 is end of life. |
| Fixed version | Apache Camel 4.22.2 on the 4.22 stream or 4.23.0 and later |
| CVSS base score | 4.8 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Apache does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Apache fixed inconsistent literal and DNS-resolved address classification that allowed blind HTTPS requests, including configured Authorization headers, to IPv6 unique-local services.
What To Validate Now
- Inventory. Inventory Camel A2A deployments, exact versions, push notification configuration paths, webhook registrants, DNS behavior, IPv6 routing, Authorization headers, owners, and maintenance windows.
- Establish applicability. Confirm that an untrusted caller can influence TaskPushNotificationConfig.url and that internal IPv6 unique-local HTTPS services are reachable; do not infer exposure from Camel use alone.
- Remediate. Upgrade to Camel 4.22.2 or 4.23.0 and later. Until then, authenticate configuration paths and deny Camel process egress to fc00::/7 as Apache recommends.
- Validate. Confirm the resolved dependency and runtime version, test permitted webhooks, verify internal ranges are rejected for literal and DNS names, review outbound requests where warranted, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The 4.21 line is end of life and will not receive a fix. Egress controls and IPv4-only settings are temporary defenses, not substitutes for moving to a supported release.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
