services / Azure / Kubernetes validating webhook configurations (admission control)

Cluster-wide Kubernetes validatingWebhookConfiguration objects (admissionregistration.k8s.io) that register webhooks validating/admitting API requests (e.g. OPA Gatekeeper, Kyverno, Pod Security) across the entire AKS-managed cluster.

Validating admission webhooks are the cluster's primary policy guardrails; controlling them governs what workloads can be admitted, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​validatingwebhookconfigurations/​write

Writing validating webhook configurations lets an attacker neuter or repoint cluster-wide policy enforcement (Gatekeeper/Kyverno/Pod Security) to admit previously-blocked privileged or malicious workloads, or set failurePolicy/scope to deny legitimate operations.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links