services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest (CSR) objects in an AKS managed cluster: requests to the cluster CA to sign an X.509 client/serving certificate. Approved CSRs carry the issued certificate in their status.certificate field, and the requested subject (username/groups) determines the identity the certificate authenticates as.

CSRs are a credential-issuance primitive; the certificate-issuance path is a well-known Kubernetes privilege-escalation vector that can mint cluster-admin (system:masters) credentials.

Microsoft.​ContainerService/​managedClusters/​certificates.​k8s.​io/​certificatesigningrequests/​read

Reading/listing CSRs returns the signed client certificate from status.certificate of approved requests (usable Kubernetes authentication credential) and enumerates the identities/groups requesting certificates.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Account discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links