Foundry Hosting toolbox MCP client could send the hosted agent's Azure bearer token to an unintended origin

### Impact An information disclosure vulnerability has been identified in Microsoft Agent Framework .NET SDK, specifically within the Foundry toolbox integration of `Microsoft.Agents.AI.Foundry.Hosting` (`FoundryToolboxService`). Under certain conditions, the toolbox MCP client could send the hosted agent's Azure bearer token to an origin other than the configured Foundry toolbox endpoint. Developers who have built Foundry hosted agents with the `Microsoft.Agents.AI.Foundry.Hosting` package and use Foundry toolboxes, either by registering them with `AddFoundryToolboxes(...)` or by using hosted toolbox markers created with `FoundryAITool.CreateHostedMcpToolbox(...)`, are impacted. ### Patches The problem has been fixed in [Microsoft.Agents.AI.Foundry.Hosting version 1.23.0-preview.260928.1](https://www.nuget.org/packages/Microsoft.Agents.AI.Foundry.Hosting/1.23.0-preview.260928.1). Users should upgrade to version 1.23.0-preview.260928.1 or higher. ### Workarounds Affected versions do not expose a setting that changes the toolbox transport. Users who cannot upgrade should stop using the built-in toolbox integration and connect to Foundry toolboxes with their own MCP client configured with `HttpTransportMode.StreamableHttp`, attaching credentials only to requests for the toolbox endpoint. ### References - [PR to add origin pinning to the Foundry toolbox MCP client](https://github.com/microsoft/agent-framework/pull/8721) - [Microsoft.Agents.AI.Foundry.Hosting 1.23.0-preview.260928.1](https://www.nuget.org/packages/Microsoft.Agents.AI.Foundry.Hosting/1.23.0-preview.260928.1)

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-346, CWE-522

• github.com/microsoft/agent-framework/security/advisories/GHSA-r2mq-wgc9-vgh3
• github.com/microsoft/agent-framework