A dataflow pulling from a plain HTTP source

Dataflow reads an external source over plaintext HTTP.

A dataflow reads from a plaintext source, so the refresh service connects unencrypted on every run and anyone observing the traffic can read or alter the records being loaded.

This is the inbound face of the same weakness a plaintext outbound endpoint carries. Only sources addressed by a URL are judged: a server-addressed source such as a bare SQL server name carries no scheme, so its transport is not visible in what Pathix captures. The finding is raised once per dataflow and names every plaintext source it found, since the fix is one pass over the queries.

Edit the dataflow and inspect the source step of each query for an http address. Only URL-shaped sources carry a scheme to read: a bare SQL server name has none, so its transport is not visible this way at all.

Change each source address to https, run a refresh to confirm the data still loads, and rotate any credential the connection has sent.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. This is the inbound face of the same weakness: the refresh service connects on every run, so anyone able to observe the traffic sees the records being loaded into Dataverse and can alter them in flight. Only URL-addressed sources are judged, since a bare server name carries no scheme to assess.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run