services / Azure / AKS managed cluster

An Azure Kubernetes Service (AKS) managed cluster: the control-plane resource that hosts a Kubernetes cluster, its node pools, networking, RBAC/Azure AD integration, and a managed/service-principal identity used to act on Azure resources.

AKS clusters are production compute assets that run workloads, hold in-cluster secrets, and act through a cluster identity; credential-listing and command-execution operations on them are effectively cluster-admin grade and warrant CRITICAL scope.

Microsoft.​ContainerService/​managedClusters/​listClusterAdminCredential/​action

Returns the clusterAdmin kubeconfig with certificate credentials granting full cluster-admin control of the Kubernetes API, bypassing Azure AD/RBAC — full cluster takeover including all in-cluster secrets and data.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links