services / Azure / Kubernetes RoleBindings

Kubernetes RoleBindings in an AKS-managed aiManagers cluster, which bind RBAC Roles/ClusterRoles to subjects (users, groups, service accounts) and thereby determine who holds which in-cluster permissions.

RBAC bindings are the cluster's access-control policy; controlling them is equivalent to controlling who can do what, up to cluster-admin.

Microsoft.​ContainerService/​aiManagers/​rbac.​authorization.​k8s.​io/​rolebindings/​delete

Deleting RoleBindings tears down RBAC grants, destroying access-control policy and stripping legitimate operators of their cluster access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links