services / Azure / Kubernetes mutating webhook configurations (admission control)

Cluster-wide Kubernetes mutatingWebhookConfiguration objects (admissionregistration.k8s.io) that register webhooks which intercept and rewrite API objects during admission across the entire AKS-managed cluster.

Mutating admission webhooks are a primary cluster-wide security/enforcement mechanism; the ability to control them approaches cluster-admin, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​delete

Deleting mutating webhook configurations strips cluster-wide admission mutation/enforcement (e.g. security sidecar injection, policy mutation), disabling defenses so malicious objects that would be mutated or rejected are admitted unchanged.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links