services / Azure / Kubernetes cluster roles (AKS Fleet)

Kubernetes ClusterRole objects in an AKS Fleet cluster, defining cluster-wide RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via (Cluster)RoleBindings.

ClusterRoles are cluster-wide access-control definitions; control over them (and the ability to bind/escalate them) can lead to full cluster-admin, the canonical CRITICAL RBAC asset.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​clusterroles/​bind/​action

The Kubernetes bind verb permits referencing this ClusterRole in a binding, letting an attacker grant its (potentially cluster-admin) permissions to a controlled subject.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links