services / Azure / AKS AI Manager secrets

Kubernetes Secret objects within an AKS AI Manager namespace holding credential material such as tokens, passwords, TLS keys, connection strings, and service-account tokens.

Reading a Secret returns the raw secret material in plaintext, so this is a credential store of the highest sensitivity.

Microsoft.​ContainerService/​aiManagers/​secrets/​write

Writing secrets lets an attacker plant or overwrite credential material consumed by workloads, establishing persistence and supplying attacker-controlled identities for lateral movement.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links