Sensitive configuration values can appear in .NET declarative workflow expression errors

### Summary Microsoft.Agents.AI.Workflows.Declarative can include sensitive configuration values in Power Fx evaluation error messages. A less-trusted workflow author who can cause a host to evaluate expressions over configuration exposed to the workflow, and can observe the resulting error text, may obtain those values. ### Details The framework marks allow-listed configuration exposed through the Env scope, and derived workflow values, as sensitive. In WorkflowExpressionEngine.EvaluateScope, a Power Fx ErrorValue was formatted into a DeclarativeActionException before the expression's sensitivity metadata was consulted. Conversion diagnostics may include the offending input, so this error path can carry sensitive data before ordinary action-level checks inspect a returned evaluation result. The resulting exception may be observable through workflow failure events, host diagnostics, or hosting integrations that expose exception details. Actual reach depends on how the host makes those errors available. ### Proof of concept Use a local unit-test fixture only, with no real credentials or external endpoints: 1. Store the inert string sample-setting as a sensitive variable named Setting in the Env scope of WorkflowFormulaState, and bind the state. 2. Evaluate ValueExpression.Expression("Value(Env.Setting)") through the workflow expression evaluator. 3. Inspect the resulting DeclarativeActionException. Before the correction, the conversion error includes sample-setting. The expected behavior is an evaluation failure whose exception text does not include the sensitive input. The regression test checks the full exception string and the absence of an inner exception carrying the original details. ### Impact The demonstrated consequence is disclosure of a protected value through expression error text. The relevant prerequisites are control of an executed workflow expression, access by that expression to sensitive host-provided state, and visibility of the resulting error details. The environment-configuration scenario requires the host to expose the relevant name through AllowedEnvironmentVariables. This report does not establish unrestricted access to arbitrary process environment variables, code execution, or modification of configuration.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-209

• github.com/microsoft/agent-framework/security/advisories/GHSA-f92h-h85c-p8w6
• github.com/microsoft/agent-framework