AGENTFORCE-AF-23: A2A Task Cancel or Subscribe Without Ownership Check
🔴 High · Broken Access Control
Detects A2A servers (Python) that authenticate callers but implement tasks/cancel or tasks/resubscribe (on_cancel_task, on_resubscribe_to_task, cancel_task helpers or /tasks/{id}/cancel|subscribe routes) by looking the task up only by its id: the store call is not scoped by the caller's context, user or tenant and the handler never compares an owner or tenant field. Any authenticated client that learns a task id (logs, push payloads, shared context ids) can cancel another tenant's task or stream its messages and artifacts.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-23 |
| Severity | High |
| Category | Broken Access Control |
| Compliance | SOC2_CC6, HIPAA |
Remediation
Record the owner (user / tenant from the authenticated call context) when a task is created, scope task lookups by it (pass the call context to the task store) and reject cancel / subscribe requests from anyone else with the same error as an unknown task id.