A webhook registered without any authentication

Webhook sends outbound calls with no authentication.

A webhook with no key or header cannot prove its calls are genuine, so anyone who learns the URL can post traffic that looks authentic.

Check the authentication configuration on each registered webhook. Ones with no key and no authentication header are the finding. Worth pairing with a check at the receiving end, since a receiver that does not validate the header is the same exposure from the other side.

Add a header-based secret and require it at the receiver; rotate it periodically.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. 3.13.8 governs what protects data in transit. With no authentication on the endpoint, nothing establishes who is at the other end of the transmission, so the channel itself is the entire control.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A password or API key written into a Power Automate flow
• A webhook or service endpoint using plaintext HTTP
• An HTTP-triggered flow anyone with the URL can run