services / Azure / Kubernetes mutating webhook configurations (fleet member)

MutatingWebhookConfigurations are cluster-wide Kubernetes admission-control objects that register webhooks intercepting and rewriting objects as they are admitted to the API server, accessed here as a data action against a fleet member cluster.

Mutating admission webhooks can rewrite every object admitted cluster-wide (inject containers, mount secrets, attach privileged identities); controlling them is the canonical Kubernetes cluster-takeover primitive, making the asset cluster-admin-equivalent.

Microsoft.​ContainerService/​fleets/​members/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​write

Creating or updating a mutating webhook lets an attacker intercept and rewrite every object admitted cluster-wide, injecting privileged sidecars/containers, mounting Secrets and service-account tokens, and attaching privileged identities, a cluster-admin-equivalent primitive enabling lateral movement, privilege escalation, workload manipulation, and bypass of admission defenses.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links