{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "item": { "id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "slug": "treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary", "url": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary.md", "json": "https://update.dsesecurity.com/api/v1/posts/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/" }, "title": "Treat OpenTelemetry Baggage as propagated context with its own trust boundary", "summary": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:51+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 245, "potentially_affected": "Review Baggage propagation, explicit attribute recording and item integrity before trusting supplied context.", "dse_recommendation": "DSE recommends allowing only necessary, nonsensitive context keys and documenting where propagation may leave the organization’s boundary.", "primary_source": { "name": "OpenTelemetry documentation — Baggage", "url": "https://opentelemetry.io/docs/concepts/signals/baggage/", "published_on": null, "authority": "opentelemetry.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Propagation does not automatically make a value a recorded span attribute or a trusted identity.

\n

Source facts

\n

OpenTelemetry Baggage is a separate key-value context store. Values become span, metric, or log attributes only when explicitly added. Automatic instrumentation can propagate Baggage in outbound requests, including to unintended third parties. The documentation also warns that Baggage has no built-in integrity check proving an item originated from the application.

\n

Source: OpenTelemetry documentation — Baggage.

\n

Applicability

\n

Review Baggage propagation, explicit attribute recording and item integrity before trusting supplied context.

\n

DSE recommendation

\n

DSE recommends allowing only necessary, nonsensitive context keys and documenting where propagation may leave the organization’s boundary. Avoid putting credentials or unrestricted personal information into Baggage. Validate externally supplied values before using them for operational decisions, and never use them alone to authorize access. Decide explicitly which values should become recorded attributes and control their cardinality. Review outbound integrations because a harmless-looking context addition can travel farther than the service that introduced it.

\n

Verification

\n

With synthetic values in a test request, inspect intended downstream propagation and recorded attributes separately. Confirm unapproved keys are excluded and that third-party requests follow the documented boundary. Verify the application does not treat a forged Baggage value as authenticated identity or authorization evidence. Retain the approved key list and synthetic outbound-header observations beside the recorded attributes. Ask the application owner to demonstrate the separate authenticated identity decision when a deliberately forged Baggage key is supplied.

\n

Official reference

\n

OpenTelemetry documentation — Baggage. Reviewed October 20, 2026.

", "content_text": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.\nSource facts\nOpenTelemetry Baggage is a separate key-value context store. Values become span, metric, or log attributes only when explicitly added. Automatic instrumentation can propagate Baggage in outbound requests, including to unintended third parties. The documentation also warns that Baggage has no built-in integrity check proving an item originated from the application.\nSource: OpenTelemetry documentation — Baggage.\nApplicability\nReview Baggage propagation, explicit attribute recording and item integrity before trusting supplied context.\nDSE recommendation\nDSE recommends allowing only necessary, nonsensitive context keys and documenting where propagation may leave the organization’s boundary. Avoid putting credentials or unrestricted personal information into Baggage. Validate externally supplied values before using them for operational decisions, and never use them alone to authorize access. Decide explicitly which values should become recorded attributes and control their cardinality. Review outbound integrations because a harmless-looking context addition can travel farther than the service that introduced it.\nVerification\nWith synthetic values in a test request, inspect intended downstream propagation and recorded attributes separately. Confirm unapproved keys are excluded and that third-party requests follow the documented boundary. Verify the application does not treat a forged Baggage value as authenticated identity or authorization evidence. Retain the approved key list and synthetic outbound-header observations beside the recorded attributes. Ask the application owner to demonstrate the separate authenticated identity decision when a deliberately forged Baggage key is supplied.\nOfficial reference\nOpenTelemetry documentation — Baggage. Reviewed October 20, 2026.", "content_markdown": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.\n\n## Source facts\n\nOpenTelemetry Baggage is a separate key-value context store. Values become span, metric, or log attributes only when explicitly added. Automatic instrumentation can propagate Baggage in outbound requests, including to unintended third parties. The documentation also warns that Baggage has no built-in integrity check proving an item originated from the application.\n\nSource: [OpenTelemetry documentation — Baggage](https://opentelemetry.io/docs/concepts/signals/baggage/).\n\n## Applicability\n\nReview Baggage propagation, explicit attribute recording and item integrity before trusting supplied context.\n\n## DSE recommendation\n\nDSE recommends allowing only necessary, nonsensitive context keys and documenting where propagation may leave the organization’s boundary. Avoid putting credentials or unrestricted personal information into Baggage. Validate externally supplied values before using them for operational decisions, and never use them alone to authorize access. Decide explicitly which values should become recorded attributes and control their cardinality. Review outbound integrations because a harmless-looking context addition can travel farther than the service that introduced it.\n\n## Verification\n\nWith synthetic values in a test request, inspect intended downstream propagation and recorded attributes separately. Confirm unapproved keys are excluded and that third-party requests follow the documented boundary. Verify the application does not treat a forged Baggage value as authenticated identity or authorization evidence. Retain the approved key list and synthetic outbound-header observations beside the recorded attributes. Ask the application owner to demonstrate the separate authenticated identity decision when a deliberately forged Baggage key is supplied.\n\n## Official reference\n\n[OpenTelemetry documentation — Baggage](https://opentelemetry.io/docs/concepts/signals/baggage/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "url": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Treat OpenTelemetry Baggage as propagated context with its own trust boundary", "item": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "url": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/", "headline": "Treat OpenTelemetry Baggage as propagated context with its own trust boundary", "description": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.", "abstract": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.", "articleBody": "Propagation does not automatically make a value a recorded span attribute or a trusted identity.\nSource facts\nOpenTelemetry Baggage is a separate key-value context store. Values become span, metric, or log attributes only when explicitly added. Automatic instrumentation can propagate Baggage in outbound requests, including to unintended third parties. The documentation also warns that Baggage has no built-in integrity check proving an item originated from the application.\nSource: OpenTelemetry documentation — Baggage.\nApplicability\nReview Baggage propagation, explicit attribute recording and item integrity before trusting supplied context.\nDSE recommendation\nDSE recommends allowing only necessary, nonsensitive context keys and documenting where propagation may leave the organization’s boundary. Avoid putting credentials or unrestricted personal information into Baggage. Validate externally supplied values before using them for operational decisions, and never use them alone to authorize access. Decide explicitly which values should become recorded attributes and control their cardinality. Review outbound integrations because a harmless-looking context addition can travel farther than the service that introduced it.\nVerification\nWith synthetic values in a test request, inspect intended downstream propagation and recorded attributes separately. Confirm unapproved keys are excluded and that third-party requests follow the documented boundary. Verify the application does not treat a forged Baggage value as authenticated identity or authorization evidence. Retain the approved key list and synthetic outbound-header observations beside the recorded attributes. Ask the application owner to demonstrate the separate authenticated identity decision when a deliberately forged Baggage key is supplied.\nOfficial reference\nOpenTelemetry documentation — Baggage. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:51+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/treat-opentelemetry-baggage-as-propagated-context-with-its-own-trust-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Treat OpenTelemetry Baggage as propagated context with its own trust boundary" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OpenTelemetry documentation — Baggage", "url": "https://opentelemetry.io/docs/concepts/signals/baggage/" } } ] } }