services / Azure / AKS managed cluster JWT authenticators

An AKS managed cluster's JWT authenticator defines how the Kubernetes API server validates external JWT/OIDC tokens, specifying trusted issuers, audiences, and claim-to-user/group mappings that bind external identities to in-cluster Kubernetes principals.

This is the cluster's authentication trust configuration; control over it is effectively cluster-admin-equivalent because it governs which identities can authenticate (and as whom) to the entire cluster.

Microsoft.​ContainerService/​managedClusters/​jwtAuthenticators/​write

Creating or updating a JWT authenticator lets an attacker register an attacker-controlled trusted token issuer or remap claims so self-minted tokens authenticate as arbitrary high-privilege cluster identities (e.g. system:masters), granting cluster-wide privilege escalation and a durable authentication backdoor.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links