services / Azure / Kubernetes CertificateSigningRequests (AKS fleet member)

CertificateSigningRequest objects on a Kubernetes cluster that is a member of an AKS fleet. They request that the cluster CA sign a client certificate for a named username/group, and approved requests carry the issued signed certificate in their status.

CSRs are the classic Kubernetes credential-minting primitive: approved requests expose usable client certificates, and creating them lets a principal request credentials for arbitrary identities including cluster-admin groups (system:masters).

Microsoft.​ContainerService/​fleets/​members/​certificates.​k8s.​io/​certificatesigningrequests/​write

Creating/updating a CSR lets an attacker request a client certificate for an arbitrary username/group (e.g. system:masters); once signed it mints durable cluster-admin credentials, enabling privilege escalation, persistent credential-based access, and movement to other identities.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links