services / Azure / API Management workspace named values

API Management named values are reusable key/value pairs (plain, secret, or Key Vault-referenced) consumed at runtime by gateway policies, commonly holding backend credentials, API keys, and connection strings.

Secret-typed named values store credential material used by API policies; the actual secret is only returned by the dedicated listValue action, while read/list returns masked metadata.

Microsoft.​ApiManagement/​service/​workspaces/​namedValues/​listValue/​action

Returns the plaintext secret of a named value (backend credentials, API keys, connection strings), enabling credential exfiltration and lateral movement to the backends those credentials access.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links