services / Azure / Kubernetes ClusterRoles

A ClusterRole is a cluster-scoped Kubernetes RBAC object that defines a named set of permissions (verbs over API resources) that can be bound to subjects cluster-wide via ClusterRoleBindings.

ClusterRoles define the permission sets behind every cluster-wide grant (the analog of Azure roleDefinitions); they can encode cluster-admin, so the asset is cluster-wide access-control policy.

Microsoft.​ContainerService/​aiManagers/​rbac.​authorization.​k8s.​io/​clusterroles/​bind/​action

The Kubernetes 'bind' verb authorizes a subject to create bindings referencing a ClusterRole, letting an attacker grant that role's (potentially cluster-admin) permissions to a controlled identity for cluster-wide privilege escalation.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links