services / Azure / Kubernetes validating webhook configurations (Fleet)

ValidatingWebhookConfigurations are cluster-scoped Kubernetes admission-control objects that register external/in-cluster webhooks invoked to validate (admit or reject) API requests. In a Fleet they govern admission enforcement across member clusters.

These objects are the cluster's policy-enforcement defense layer (e.g. Pod Security, OPA/Gatekeeper, Kyverno). Controlling them is effectively controlling whether security policy is enforced.

Microsoft.​ContainerService/​fleets/​admissionregistration.​k8s.​io/​validatingwebhookconfigurations/​write

Creating/updating webhook configs lets an attacker fail-open or narrow admission policy to bypass enforcement (defense destruction), and can register an attacker-controlled webhook endpoint that intercepts every matching API object (including secrets) for exfiltration and tampers with admission decisions.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links