services / Azure / Kubernetes mutating webhook configurations (admission control)

Cluster-wide Kubernetes mutatingWebhookConfiguration objects (admissionregistration.k8s.io) that register webhooks which intercept and rewrite API objects during admission across the entire AKS-managed cluster.

Mutating admission webhooks are a primary cluster-wide security/enforcement mechanism; the ability to control them approaches cluster-admin, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​write

Registering a mutating webhook is a classic full-cluster takeover primitive: it intercepts and rewrites every admitted object cluster-wide (inject privileged sidecars, attach service accounts/managed identities, mount secrets), can read secret-bearing admission payloads, and disables mutating security defenses.

Risks

1. Data exfiltration (CRITICAL)
2. Privilege escalation (CRITICAL)
3. Data manipulation (HIGH)
4. Lateral movement (BOOST)
5. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links