services / Azure / Kubernetes secrets (Fleet member)

Kubernetes Secret objects in a namespace of an AKS Fleet member cluster. They hold credential material such as service-account tokens, TLS private keys, image-pull credentials, passwords, and connection strings consumed by workloads.

Secrets are first-class credential stores; reading them yields directly usable identity material enabling lateral movement and takeover across the cluster and connected systems.

Microsoft.​ContainerService/​fleets/​members/​secrets/​read

Reading/listing Secrets returns raw credential material (tokens, keys, passwords, connection strings), enabling direct cryptographic exfiltration, lateral movement to the identities they authenticate, and account takeover.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links