AGENTFORCE-AF-04: Broker Privilege Escalation via Routing

🔴 High · MuleSoft Agent Fabric

Detects Agent Fabric brokers with routing strategies (fallback, round-robin) that route across agents at different privilege levels. A low-privilege request may be routed to a high-privilege agent through fallback, enabling indirect privilege escalation.

Details

Field	Value
Rule ID	AGENTFORCE-AF-04
Severity	High
Category	MuleSoft Agent Fabric

Remediation

Separate brokers by privilege tier, or use 'capability-based' routing instead of '<strategy>' to prevent cross-tier escalation.

See Also

• Rule catalog index
• Scanning basics
• SARIF output