services / Azure / Fleet hub Kubernetes mutating webhook configurations

Mutating webhook configurations are cluster-scoped Kubernetes admission-control objects on the Fleet Manager hub cluster that register webhooks which intercept and can rewrite objects submitted to the API server.

Mutating admission webhooks are a cluster-admin-tier security primitive able to alter every matching object created cluster-wide.

Microsoft.​ContainerService/​fleets/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​delete

Deleting mutating webhook configurations removes admission controllers that frequently enforce security/policy (e.g. Gatekeeper, Kyverno, image/identity verification), disabling those defenses across the cluster.

Risks

1. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links