Request tunnelling is a desynchronisation technique in which a smuggled request is carried through a connection that the front end does not reuse for other users. Unlike classic cross-user smuggling, the attacker may only observe their own responses, so detection and confirmation depend on timing, header leakage, or side effects.
Expanded Definition
Request tunnelling is a request smuggling pattern where the attacker relies on a front-end and back-end parsing mismatch, but the payload is carried in a connection that is not reused for other users. That distinction matters: the malicious request is still desynchronised, yet the attacker often sees only their own responses, so confirmation depends on timing anomalies, unexpected header reflection, or observable side effects rather than cross-user response theft.
In NHI and agentic systems, the risk appears when reverse proxies, API gateways, load balancers, or service meshes make inconsistent assumptions about connection reuse and request boundaries. Definitions vary across vendors, and no single standard governs this yet, so practitioners should treat the term as an operational pattern rather than a formal protocol class. The security concern is not just injection, but the ability to alter downstream request flow in a way that is hard to attribute from the outside. For a broader NHI governance lens, see Ultimate Guide to NHIs and the architectural boundary thinking in NIST Cybersecurity Framework 2.0.
The most common misapplication is treating request tunnelling as a generic latency problem, which occurs when teams ignore parser disagreement and only investigate slow responses.
Examples and Use Cases
Implementing defences against request tunnelling rigorously often introduces operational friction, requiring organisations to weigh stricter parsing consistency and connection handling against higher gateway complexity and potential performance cost.
- An API gateway forwards a malformed request over a dedicated upstream connection, letting the attacker desynchronise the back end without affecting other users.
- A service mesh normalises headers differently from the origin service, creating a path where a smuggled request is hidden inside what looks like a single legitimate transaction.
- A reverse proxy closes client sessions cleanly, but the upstream connection remains ambiguous long enough for a crafted payload to be processed out of order.
- Security engineers validate whether the issue is present by comparing behaviour against parser expectations described in the NIST Cybersecurity Framework 2.0 and by reviewing NHI exposure patterns in Ultimate Guide to NHIs.
- An agentic workflow that calls internal tools through HTTP can accidentally preserve attacker-controlled framing across hop boundaries, turning a parsing flaw into a control-plane abuse path.
Why It Matters in NHI Security
Request tunnelling matters because NHI environments are dominated by machine-to-machine traffic, where gateways, brokers, and service identities often operate at high volume and low observability. When parsing boundaries are inconsistent, an attacker may use one request to influence another backend action while leaving little direct evidence in logs. That makes the issue especially dangerous in systems that carry secrets, token exchanges, or privileged API calls. NHI Mgmt Group research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, and 79% have experienced secrets leaks, with 77% resulting in tangible damage, according to the Ultimate Guide to NHIs. A smuggling path that only exposes the attacker’s own responses can still be enough to trigger credential misuse, workflow manipulation, or lateral movement in an agentic pipeline. For governance, the right response is to align parsing controls, request logging, and trust boundaries with NIST Cybersecurity Framework 2.0.
Organisations typically encounter the impact only after a proxy anomaly, failed token exchange, or unexplained downstream action, at which point request tunnelling becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | JSON null | Covers agent and tool-request abuse patterns where desync changes execution flow. |
| OWASP Non-Human Identity Top 10 | NHI-04 | Relates to request-path abuse that can expose or misuse NHI credentials and tokens. |
| NIST CSF 2.0 | PR.PT-4 | Addresses protective technology controls for boundary protection and traffic inspection. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust segmentation depends on trustworthy request boundaries and intermediary enforcement. |
| NIST AI RMF | MAP | AI risk mapping must account for indirect prompt or tool-chain manipulation through desync. |
Map request-routing assumptions and document where parsing gaps could redirect AI-controlled actions.
Related resources from NHI Mgmt Group
- What is the difference between network trust and request-level identity trust?
- Why do access-request workflows matter for NHI governance?
- How should organisations use AI in access request approval without weakening control?
- What is the difference between access request automation and access governance?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
