Back to Jaeger

Jaeger Threat Model

docs/security/threat-model.md

2.17.06.1 KB
Original Source

Jaeger Threat Model

This document describes the threat model for the Jaeger distributed tracing system.

Overview

Jaeger is a distributed tracing platform that collects, processes, and visualizes trace data from instrumented applications. This threat model identifies potential threats and the controls implemented to mitigate them.

System Architecture

┌─────────────────┐      ┌─────────────────┐      ┌─────────────────┐
│  Instrumented   │      │     Jaeger      │      │    Storage      │
│  Applications   │─────▶│    Collector    │─────▶│    Backend      │
│  (OTel SDK)     │      │                 │      │ (ES/Cassandra)  │
└─────────────────┘      └─────────────────┘      └────────┬────────┘
                                                           │
                         ┌─────────────────┐               │
                         │     Jaeger      │◀──────────────┘
                         │   Query + UI    │
                         └────────┬────────┘
                                  │
                         ┌────────▼────────┐
                         │      Users      │
                         │    (Browser)    │
                         └─────────────────┘

Trust Boundaries

BoundaryDescriptionSecurity Controls
B1: SDK → CollectorExternal applications sending spansTLS/mTLS, rate limiting, schema validation
B2: Collector → StorageInternal service to databaseTLS, authentication, authorized credentials
B3: Storage → QueryDatabase to internal serviceTLS, authentication, read-only access
B4: Query → UsersInternal service to end usersTLS, bearer tokens, RBAC

Threat Actors

ActorDescriptionMotivation
Malicious ApplicationCompromised or rogue service sending tracesData poisoning, DoS, information injection
External AttackerAttacker with network accessData exfiltration, reconnaissance, DoS
Malicious InsiderUser with legitimate accessUnauthorized data access, privilege escalation
Man-in-the-MiddleAttacker on network pathData interception, tampering

Threats and Mitigations

T1: Denial of Service via Span Flooding

Description: Malicious or misconfigured application sends excessive spans.

AttributeValue
Threat ActorMalicious Application
ImpactHigh - Can overwhelm collector and storage
LikelihoodMedium

Mitigations:

  • Rate limiting at collector
  • Adaptive sampling to reduce volume
  • Resource quotas per service
  • Kafka buffering for burst handling

T2: Sensitive Data Exposure in Traces

Description: Traces may inadvertently contain sensitive data (PII, credentials).

AttributeValue
Threat ActorExternal Attacker, Malicious Insider
ImpactHigh - Data breach
LikelihoodMedium

Mitigations:

  • TLS encryption for all connections
  • Access control (RBAC) on Query service
  • Data retention policies
  • Guidance for users on what not to trace

T3: Man-in-the-Middle Attack

Description: Attacker intercepts unencrypted trace traffic.

AttributeValue
Threat ActorMan-in-the-Middle
ImpactHigh - Data interception and tampering
LikelihoodLow (with TLS)

Mitigations:

  • TLS/mTLS for all communications
  • Certificate verification enabled by default
  • Certificate pinning optional

T4: Unauthorized Access to Trace Data

Description: Unauthorized user accesses the Query UI/API.

AttributeValue
Threat ActorExternal Attacker, Malicious Insider
ImpactMedium - Information disclosure
LikelihoodMedium

Mitigations:

  • Bearer token authentication
  • OAuth2 integration
  • RBAC for access control
  • Audit logging

T5: Storage Backend Compromise

Description: Attacker gains access to the storage backend directly.

AttributeValue
Threat ActorExternal Attacker
ImpactHigh - Full data access
LikelihoodLow

Mitigations:

  • Storage-level authentication
  • Network isolation
  • Encrypted connections to storage
  • Storage-level access controls

T6: Supply Chain Attack

Description: Compromised dependency introduced into build.

AttributeValue
Threat ActorExternal Attacker
ImpactCritical - Code execution
LikelihoodLow

Mitigations:

  • Dependabot vulnerability scanning
  • Signed commits (DCO)
  • GPG-signed releases
  • SBOM generation
  • Pinned dependencies with checksums

Security Recommendations

For Operators

  1. Enable TLS everywhere - Use tls.insecure: false for all connections
  2. Use mTLS - Especially for collector ingestion
  3. Configure authentication - Enable bearer tokens or OAuth2
  4. Set up RBAC - Limit who can access trace data
  5. Enable audit logging - Track access to sensitive traces
  6. Use network segmentation - Isolate Jaeger components

For Developers Instrumenting Applications

  1. Never trace credentials - Avoid logging passwords, tokens, API keys
  2. Sanitize PII - Don't include personal information in spans
  3. Use sampling - Reduce volume and exposure
  4. Review span content - Audit what data is being traced

References