AGENTFORCE-AF-15: Mule SSRF via Request-Controlled URL
🔴 High · MuleSoft Agent Fabric
Detects <http:request> calls whose url or host comes from request input (query / URI parameters, headers, payload, or variables set from them) in MCP tool flows, A2A task flows, or HTTP endpoints of an app that serves MCP / A2A, with no validation of the target.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-15 |
| Severity | High |
| Category | MuleSoft Agent Fabric |
Remediation
Do not take the target host from input. Use a fixed http:request-config host and pass only a validated path or id; if several targets are needed, map an input key to an allowlisted URL and reject everything else.