services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects (certificates.k8s.io) used to request and issue X.509 client/serving certificates that authenticate identities to the cluster API server.

An approved CSR's status.certificate field contains a signed client certificate that is a usable cluster credential; CSRs are a well-known Kubernetes privilege-escalation and credential-minting vector, making this a CRITICAL identity/credential asset.

Microsoft.​ContainerService/​aiManagers/​certificates.​k8s.​io/​certificatesigningrequests/​read

Reading/listing CSRs can return the signed client certificate in status.certificate (usable authentication credential) and enumerates the identities/groups requesting cluster access; the exported cert authenticates as the requested identity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links