services / Azure / Kubernetes secrets (Fleet member)

Kubernetes Secret objects in a namespace of an AKS Fleet member cluster. They hold credential material such as service-account tokens, TLS private keys, image-pull credentials, passwords, and connection strings consumed by workloads.

Secrets are first-class credential stores; reading them yields directly usable identity material enabling lateral movement and takeover across the cluster and connected systems.

Microsoft.​ContainerService/​fleets/​members/​secrets/​write

Writing Secrets lets an attacker plant or overwrite credential material consumed by workloads, manipulating authentication data, establishing persistent attacker-controlled credentials, and enabling lateral movement via injected identities.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links