services / Azure / Fleet hub Kubernetes mutating webhook configurations

Mutating webhook configurations are cluster-scoped Kubernetes admission-control objects on the Fleet Manager hub cluster that register webhooks which intercept and can rewrite objects submitted to the API server.

Mutating admission webhooks are a cluster-admin-tier security primitive able to alter every matching object created cluster-wide.

Microsoft.​ContainerService/​fleets/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​write

Writing a mutating webhook configuration registers a webhook that intercepts and rewrites every matching admission request (inject privileged sidecars/credentials, alter pod specs), a classic cluster-wide privilege-escalation, tampering, and admission-defense bypass primitive.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links