The default TLS configuration in go-micro's internal/util/tls/tls.go disables certificate verification for all service-to-service gRPC and HTTP communication. The code itself contains a SECURITY WARNING and DEPRECATION NOTICE acknowledging this is insecure and vulnerable to MITM attacks — but the default has not been changed, citing backward compatibility.
internal/util/tls/tls.go:28-66 :
Secure mode requires explicit opt-in via MICRO_TLS_SECURE=true . The framework provides SecureConfig() and InsecureConfig() helpers, but Config() — the default path used by all services — is insecure.
Every service built on go-micro that does not set MICRO_TLS_SECURE=true transmits all inter-service data over unverified TLS:
A network-adjacent attacker can intercept and tamper with all service-to-service traffic.
Option A (Recommended): Change the default.
Option B: Invert the opt-in.
Either way, the default should be secure. Full technical report available on request.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
