services / Azure / Kubernetes mutating webhook configurations (fleet member)

MutatingWebhookConfigurations are cluster-wide Kubernetes admission-control objects that register webhooks intercepting and rewriting objects as they are admitted to the API server, accessed here as a data action against a fleet member cluster.

Mutating admission webhooks can rewrite every object admitted cluster-wide (inject containers, mount secrets, attach privileged identities); controlling them is the canonical Kubernetes cluster-takeover primitive, making the asset cluster-admin-equivalent.

Microsoft.​ContainerService/​fleets/​members/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​delete

Deleting mutating webhook configurations removes admission-time controls that frequently enforce security defaults (sidecar/policy/identity injection), disabling a defense; deleting a failurePolicy=Fail webhook can also block all matching admissions, disrupting cluster operations.

Risks

1. Denial-of-service (HIGH)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links