Server-Side Request Forgery Risk in Apache Camel A2A Component

CVE-2026-71569

What is CVE-2026-71569?

An issue has been identified in the Apache Camel A2A component that presents a Server-Side Request Forgery (SSRF) vulnerability. This flaw arises from discrepancies in how a webhook URL's host is validated. Specifically, hosts represented as IP literals can be matched against an outdated prefix list, while those resolved through hostname lookups may not undergo the same rigorous classification checks. Consequently, this inconsistency can allow malicious actors to exploit the flaw, enabling unauthorized outbound requests to internal addresses, depending on how the addresses are formatted. Users are advised to upgrade to version 4.23.0 or 4.22.2 as soon as possible to mitigate risks, with additional recommendations to implement network level restrictions and secure authentication measures temporarily. The vulnerability notably allows for a blind outbound HTTPS request, posing significant risks if left unaddressed.

References