services / Azure / Kubernetes ClusterRoles (AKS Fleet member)

Kubernetes ClusterRole objects on a member cluster of an AKS Fleet. ClusterRoles define cluster-wide permission sets (verbs over resources) that bindings can grant to subjects.

Cluster-wide RBAC permission definitions; creating/expanding or binding them enables cluster-admin escalation, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​fleets/​members/​rbac.​authorization.​k8s.​io/​clusterroles/​escalate/​action

The Kubernetes 'escalate' verb explicitly bypasses the privilege-escalation prevention check, letting an attacker add permissions to a ClusterRole that exceed those they currently hold, enabling unbounded cluster-wide privilege escalation.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links