AGENTFORCE-AF-14: Mule Outbound TLS Validation Disabled
🟡 Medium · MuleSoft Agent Fabric
Detects <tls:trust-store insecure="true"/> on outbound Mule connections (HTTP request configs, MCP / A2A clients, OAuth token calls) in apps that serve or call agents: any certificate is accepted, so the peer can be impersonated. High when agent tool flows use the connection; low for loopback hosts.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-14 |
| Severity | Medium |
| Category | MuleSoft Agent Fabric |
Remediation
Remove insecure="true" and configure a trust store with the server's CA (or rely on the JVM default trust store). For local testing, keep the insecure setting in a test-only configuration file.