AGENTFORCE-AF-20: Caller-Controlled A2A Push-Notification URL
🔴 High · Network Security
Detects A2A servers that accept a push-notification URL from the client (pushNotificationConfig) and later POST task updates to it with no host allowlist or private-address check, so a caller can make the agent send requests and task data to internal hosts or a server it controls.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-20 |
| Severity | High |
| Category | Network Security |
| Compliance | SOC2_CC7 |
Remediation
Validate push-notification URLs before storing them: https only, host on an allowlist (or at least resolve and reject private, loopback and link-local addresses), and authenticate the notifications you send (JWT signed by the agent) so receivers can verify them.