services / Azure / Container registry

An Azure Container Registry (ACR) resource that stores and serves container images and OCI artifacts (Helm charts, etc.) consumed by clusters and CI/CD pipelines.

The registry backs the image supply chain for one or more applications; its credentials and stored images are sensitive, but control-plane property reads are low-sensitivity.

Microsoft.​ContainerRegistry/​registries/​listCredentials/​action

Returns the registry admin username and passwords, a reusable standalone credential granting full push/pull access; an attacker can exfiltrate it, authenticate as the registry account, and move laterally into the image supply chain.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links