Microsoft: observable discrepancy

### Summary Microsoft Agent Framework's .NET declarative workflow expression evaluator can expose information about sensitive configuration through value-dependent execution differences. An author able to supply workflow definitions to a host that exposes protected configuration to those workflows can distinguish sensitive predicates through evaluation failures or inconsistent handling of blank boolean results, without directly sending a sensitive-labelled value to an output action. ### Details The affected package is Microsoft.Agents.AI.Workflows.Declarative. In WorkflowExpressionEngine.EvaluateScope, Power Fx evaluation errors caused an exception and stopped the workflow before sensitivity metadata could govern subsequent use of the result. Whether evaluation failed could depend on protected input. Redacting the exception message alone does not remove the observable stop/continue distinction. Separately, WorkflowExpressionEngine.Evaluate(BoolExpression) converted a blank result to false with SensitivityLevel.None, even when its input was sensitive. A non-blank sensitive boolean was rejected by control-flow validation, while a sensitive blank result could be accepted. This made acceptance itself dependent on the protected value. The reported configuration exposes allow-listed Env values as sensitive and permits workflow execution by an untrusted author. Observable completion or action dispatch can provide the signal; permitted HTTP or MCP actions can make that signal externally observable even when their arguments are non-sensitive. ### Proof of concept Use an isolated unit-test host, synthetic data only, and in-memory action recorders. Do not use real credentials, network endpoints, or production services. 1. Seed a synthetic boolean setting in the Env scope with Sensitive metadata. Repeat the test with true and false. 2. Place a data-assignment action between two in-memory marker actions. Have the assignment's expression conditionally produce a Power Fx evaluation error or an ordinary value based on the synthetic setting. 3. On affected code, one input causes an exception and prevents the second marker, while the other allows both markers. Expected behavior is that sensitive evaluation errors do not disclose the predicate through assignment continuation and that sensitivity metadata is preserved. 4. In a separate test, use a sensitive boolean expression that produces either false or Blank as a ConditionGroup condition. On affected code, the false result is rejected as sensitive, while Blank loses its label and is accepted as false. Expected behavior is rejection of the sensitive condition for both inputs. The remediation regression tests cover both input values, preserved metadata, continued assignment, and consistent rejection of sensitive conditions. ### Impact An attacker must be able to supply or alter a declarative workflow executed by a host that makes protected configuration available to it, and observe execution differences. For the reported outbound-observation scenario, the host must also permit HTTP or MCP actions to an observer-accessible destination. Repeated executions can reveal predicates about protected values and enable reconstruction of sensitive configuration. This report concerns an implicit control-flow disclosure, not a direct transmission of a sensitive-labelled value. It does not establish exposure in hosts that do not provide sensitive data to untrusted workflows, or establish actual compromise of any deployment.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-203, CWE-755

• github.com/microsoft/agent-framework/security/advisories/GHSA-68cw-g4g7-7h9f
• github.com/microsoft/agent-framework