services / Azure / Kubernetes secrets (fleet)

Kubernetes Secret objects within an AKS fleet namespace, which store credential material such as service-account tokens, TLS keys, passwords, connection strings, and registry credentials consumed by workloads.

Holds live credential/cryptographic material; compromise yields identity takeover and lateral movement across the cluster and connected systems.

Microsoft.​ContainerService/​fleets/​secrets/​write

Writing Secrets lets an attacker plant or overwrite credential material consumed by workloads, establishing persistence, manipulating trusted configuration, and injecting attacker-controlled credentials to pivot to other identities.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links