services / Azure / Kubernetes cluster roles (AKS Fleet)

Kubernetes ClusterRole objects in an AKS Fleet cluster, defining cluster-wide RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via (Cluster)RoleBindings.

ClusterRoles are cluster-wide access-control definitions; control over them (and the ability to bind/escalate them) can lead to full cluster-admin, the canonical CRITICAL RBAC asset.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​clusterroles/​write

Creating/updating a ClusterRole lets an attacker define arbitrary cluster-wide permissions (e.g. all verbs on all resources) that escalate any subject bound to that role.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links