hermes - 💡(How to fix) Fix [a2a_fleet] CRITICAL: auth_required defaults to false on a cross-machine surface

Severity: CRITICAL (security — insecure default)

Inbound /jsonrpc auth is off by default on a surface explicitly designed for cross-machine peers.

Evidence

• plugins/a2a_fleet/fleet_config.py:111 — auth_required defaults to False.
• plugins/a2a_fleet/server.py:108-111 — _check_bearer returns None (allows) when auth_required is false.
• plugins/a2a_fleet/server.py:3-7 — module docstring markets the surface for cross-machine access; README/agent-card advertise bearer auth.

Default-open + intended off-host binding = unauthenticated /jsonrpc exposed to the LAN whenever bind_host is set non-loopback.

Related (A2A-8, folded)

server.py:117-127 returns HTTP 500 for the auth-misconfig case (other auth failures return 401) and the 500 message discloses that token_env is unset — config-state leak.

Fix

• Default auth_required to True; or refuse to bind a non-loopback bind_host while auth_required is false.
• Document the plaintext-bearer-over-HTTP risk in the server module docstring (no TLS in v0.1).
• Return 401/503 with a generic message for auth-misconfig; do not disclose token_env state.

Filed from opus-4.8 plugin audit (a2a_fleet).