services / Azure / Container registry quarantined artifacts

Container artifacts (image layers/manifests) held in quarantine pending vulnerability/compliance scanning before being released for general pull; the data action accesses their actual content.

Data-plane access to registry image content, which may include proprietary application code, binaries, and embedded secrets.

Microsoft.​ContainerRegistry/​registries/​quarantinedArtifacts/​read

Pulls/reads quarantined artifact content, exporting unvetted container image data (potentially including code and embedded secrets) out of the registry.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links