services / Azure / Kubernetes CertificateSigningRequests (AKS fleet member)

CertificateSigningRequest objects on a Kubernetes cluster that is a member of an AKS fleet. They request that the cluster CA sign a client certificate for a named username/group, and approved requests carry the issued signed certificate in their status.

CSRs are the classic Kubernetes credential-minting primitive: approved requests expose usable client certificates, and creating them lets a principal request credentials for arbitrary identities including cluster-admin groups (system:masters).

Microsoft.​ContainerService/​fleets/​members/​certificates.​k8s.​io/​certificatesigningrequests/​read

Reading CSRs returns the issued signed client certificate embedded in status.certificate of approved requests, which is reusable identity credential material that authenticates as the requested cluster identity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links