Rules / CFG040

CFG040 permissions.allow contains unrestricted WebFetch

Severity: warn OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

cfgaudit flags a permissions.allow entry that grants unrestricted WebFetch — Claude can then fetch any URL, an exfiltration channel for data or secrets in the environment. Flagged forms:

• WebFetch (bare)
• WebFetch() / WebFetch(*)
• WebFetch(domain:*) / WebFetch(url:*)

Scoped entries like WebFetch(domain:api.example.com) are not flagged.

Note: restricting WebFetch alone does not stop network access if Bash(curl *) / Bash(wget *) is also allowed — those are covered by CFG023.

Trigger example

{ "permissions": { "allow": ["WebFetch(domain:*)"] } }

Safe alternative

{ "permissions": { "allow": ["WebFetch(domain:api.example.com)"] } }

References

• Claude Code docs: Permissions
• CFG023: dangerous Bash(...) allow patterns (incl. curl/wget network egress)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation