A custom connector whose host uses plain HTTP

Custom connector sends its calls over plaintext HTTP.

A custom connector declares a plaintext host, so every operation it exposes, called by every flow and app that binds it, crosses the network unencrypted.

The connector runs in the Power Platform connector runtime rather than a browser, so nothing blocks the request the way mixed-content protection blocks a page. The traffic simply goes out in the clear, carrying whatever the caller sends and whatever credential the connection presents. Where the host is internal and cannot offer TLS, front it with a terminating proxy or reach it through an on-premises data gateway.

Open the custom connector and view its Swagger or OpenAPI definition, then read the declared host and schemes. Anything on http rather than https is the finding. A connector whose definition names no resolvable host has nothing to judge.

Move the service behind https, update the connector's host, and rotate any credential the connection has already sent.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. Every operation the connector exposes targets the declared host, so every call made through it by every flow and app crosses the network in the clear. The connector runs in the Power Platform connector runtime rather than a browser, so nothing blocks it the way mixed-content protection blocks a page.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run