services / Azure / Kubernetes roles (AKS Fleet)

Kubernetes Role objects in an AKS Fleet cluster, defining namespaced RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via RoleBindings.

Roles are namespaced access-control definitions; combined with bind/escalate they enable privilege escalation, so the RBAC asset class is treated as CRITICAL.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​roles/​write

Creating/updating a Role lets an attacker define arbitrary namespaced permissions that escalate any subject bound to that role.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links