services / Azure / Container registry

An Azure Container Registry (ACR) resource that stores and serves container images and OCI artifacts (Helm charts, etc.) consumed by clusters and CI/CD pipelines.

The registry backs the image supply chain for one or more applications; its credentials and stored images are sensitive, but control-plane property reads are low-sensitivity.

Microsoft.​ContainerRegistry/​registries/​regenerateCredential/​action

Regenerates an admin login password, returning the new usable credential to the caller while invalidating the prior one, denying access to legitimate clients that relied on it.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)
3. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links