services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects in an AKS fleet, which request and (once approved/signed) carry issued client certificates used to authenticate identities to the cluster API.

CSRs are PKI/credential material: an approved CSR's status field contains a signed client certificate usable to authenticate as an arbitrary subject, including cluster-admin groups.

Microsoft.​ContainerService/​fleets/​certificates.​k8s.​io/​certificatesigningrequests/​read

Reading CSRs returns the issued client certificate in status.certificate (usable authentication credential) and reveals the requested subjects/groups, exposing both crypto material and identity-provisioning detail.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Policy discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links