services / Azure / AKS AI Manager secrets

Kubernetes Secret objects within an AKS AI Manager namespace holding credential material such as tokens, passwords, TLS keys, connection strings, and service-account tokens.

Reading a Secret returns the raw secret material in plaintext, so this is a credential store of the highest sensitivity.

Microsoft.​ContainerService/​aiManagers/​secrets/​read

Reading secrets returns raw credential/key material that can be exfiltrated and reused to impersonate the identities those secrets authenticate.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links