The security patch adds ACL token parsing and authorization checks to both AgentHealthServiceByID and AgentHealthServiceByName methods in agent_endpoint.go. The commit message explicitly states these endpoints were missing ACL enforcement. The vulnerable functions are the HTTP handler methods that process /v1/agent/health/service/id/{id} and /v1/agent/health/service/name/{name} endpoints. In vulnerable versions, these functions would appear in runtime profiles when handling unauthorized requests to these endpoints as they processed sensitive health checks without proper authorization.