services / Azure / Kubernetes mutating webhook configurations (AKS)

Cluster-wide Kubernetes mutating admission webhook configurations on an AKS managed cluster that intercept and can rewrite API objects before they are persisted.

Mutating webhooks are a primary admission enforcement and injection mechanism; controlling them is effectively cluster-admin over every workload.

Microsoft.​ContainerService/​managedClusters/​admissionregistration.​k8s.​io/​mutatingwebhookconfigurations/​write

Creating/updating a mutating webhook lets an attacker silently rewrite every admitted object cluster-wide (inject privileged sidecars/credentials, mount secrets, change service accounts) and point it at an attacker endpoint, yielding cluster-admin-level privilege escalation, lateral movement, and bypass of admission defenses.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links