AGENTFORCE-AF-21: A2A Task Endpoint Without Authentication
🔴 High · Agent Network Security
Detects A2A agent servers written in Java (JAX-RS / Quarkus / Spring, or the A2A Java SDK) whose task endpoints (message/send, message/stream, tasks/get, tasks/cancel, push-notification config) accept requests with no authentication: no @RolesAllowed / @Authenticated / @PreAuthorize, no principal or identity check, no security filter or framework auth policy; or whose security filter fails open (lets requests through when no credential is configured or on an exception). Anyone who can reach the server can send tasks, read other clients' task history and results, cancel tasks, or register push-notification URLs. Severity: high; critical when the filter fails open or the agent card advertises a security scheme the server does not enforce.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-21 |
| Severity | High |
| Category | Agent Network Security |
Remediation
Enforce the security scheme the agent card advertises on every task endpoint (Quarkus quarkus.http.auth.permission policy or @Authenticated / @RolesAllowed, Spring SecurityFilterChain), make filters deny when the credential is missing or verification throws, and check that the caller owns the task id.