Skip to main content
Agent server or API endpoint exposed without authentication or TLS

​
How to resolve

Enable TLS on all agent endpoints. Implement authentication (OAuth 2.0, API key verification) and restrict binding to specific network interfaces.

​
Risk

Governance/Compliance This vulnerability falls under ASI03:2026 — Identity and Privilege Abuse in the OWASP Top 10 for Agentic Applications. Agents inherit, reuse, or escalate identities and credentials beyond their functional scope. Security Agent server or API endpoint exposed without authentication or TLS. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent server or API endpoint exposed without authentication or TLS. This falls under ASI03 (Identity and Privilege Abuse): Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

​
Specifications

Trigger
  • Agent scan detects agent server or API endpoint exposed without authentication or TLS
The scanner looks for patterns such as:
  • app.run() with no auth middleware
  • uvicorn.run(host=‘0.0.0.0’) with no token check
  • FastAPI/Flask routes with no authentication decorator
  • HTTP server binding to 0.0.0.0
Severity
  • CRITICAL
Applies to: Agent