A Server-Side Request Forgery (SSRF) vulnerability exists in the Apache Camel A2A component versions from 4.21.0 before 4.22.2. The issue arises from inconsistent classification of webhook host addresses, allowing an attacker-controlled webhook URL to cause the Camel process to make blind outbound HTTPS requests to internal IPv6 unique local addresses (fc00::/7). This could lead to unauthorized internal network access with medium severity impact. The vulnerability is fixed in Apache Camel versions 4.22.2 and 4.23.0.