AGENTFORCE-AF-19: Unauthenticated Endpoint Calls an Agent With the Server's Credential
🔴 High · Broken Access Control
Detects HTTP endpoints (Mule http:listener flows, Express / Next.js / FastAPI / Flask routes) that have no authentication of their own but call an A2A agent or MCP server with a token the server holds (app config or environment). Any caller gets the server's access to the agent: a confused deputy.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-19 |
| Severity | High |
| Category | Broken Access Control |
| Compliance | SOC2_CC6, HIPAA |
Remediation
Authenticate the endpoint itself (session, JWT or API key checked on every request, or an API gateway policy / Mule security filter) and pass the caller's identity to the agent; or exchange the caller's token for a downstream token (OAuth token exchange) instead of attaching the server's own credential to every request.