AGENTFORCE-AF-24: Credential Logged or Leaked by Java Agent Server
🔴 High · Credential Exposure
Detects Java agent servers (A2A, MCP or agent-framework projects) that write credentials in cleartext: tokens, client secrets, passwords, API keys or the Authorization / Cookie header (or every request header) passed to a logger or System.out, concatenated into an exception message, or appended to a URL query string. Agent servers forward bearer tokens between agents and push endpoints, so a log line or an error returned to another agent hands over a reusable credential. Masked values (mask/redact/hash, length, null checks) are ignored. Severity: high for logs, header dumps and exception messages, medium for URL query strings.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-24 |
| Severity | High |
| Category | Credential Exposure |
| Compliance | SOC2_CC6, PCI_DSS |
Remediation
Never log or echo credential values: log a fixed marker or a short hash, strip Authorization / Cookie from header dumps, keep exception messages free of secrets, and send tokens in an Authorization header instead of the URL.