auditing-observability-pipeline-collector-trust

Auditing observability pipeline collector trust: when telemetry is an untrusted input

A telemetry collector sits in a trusted spot, workloads and infrastructure send it their logs, metrics, and traces, and it forwards, transforms, and stores that data with credentials that reach real backends. That position makes it an under-examined trust boundary. The data it ingests is often accepted without authenticating the sender, so anyone who can reach the ingestion endpoint can inject telemetry. The processors that transform that data can be driven by fields the sender controls, and a processor that executes, routes, or queries based on a telemetry field acts on attacker input. The collector's own credentials and exporters can reach sensitive destinations, so compromising the pipeline reaches the backends it writes to. You audit these by checking whether ingestion is authenticated and whether any processor or exporter acts on attacker-controllable content.

When to use

• A telemetry collector or agent ingests logs, metrics, or traces from workloads or the network.
• The collector transforms, routes, or stores telemetry, and processors may read sender-controlled fields.
• The collector runs with credentials whose exporters reach databases, object stores, or other backends.

Scope check

Test collectors and pipelines only in environments you own or are authorized to assess, on non-production telemetry. Injecting telemetry or exercising a processor touches a live pipeline, so keep any payload benign and inside the authorized environment. If you can't name the authorization, stop.

The loop

1. Establish the intended senders first. Name who is supposed to send telemetry to each ingestion endpoint: which workloads, which agents. This is the false-positive killer: an endpoint reachable only by authenticated intended senders, whose processors treat telemetry as inert data, is correct. Name the senders, then check ingestion and processing against that.

2. Check ingestion authentication and reachability. Determine whether each ingestion endpoint authenticates the sender or accepts telemetry from anyone who can reach it. An unauthenticated endpoint reachable beyond the intended senders lets an attacker inject arbitrary logs, metrics, or traces, which is the entry point for everything downstream. Confirm the network reachability and the auth requirement.