services / Azure / AKS Kubernetes cluster roles

A Kubernetes ClusterRole defines a set of permissions over cluster-scoped and namespaced resources across the entire cluster. On AKS this is a data-plane RBAC permission definition.

Cluster roles define cluster-wide permission sets (up to cluster-admin); they are core cluster access-control policy objects.

Microsoft.​ContainerService/​managedClusters/​rbac.​authorization.​k8s.​io/​clusterroles/​escalate/​action

The Kubernetes 'escalate' verb explicitly bypasses RBAC's privilege-escalation guard, letting an attacker author/modify a ClusterRole to grant permissions exceeding their own and reach cluster-admin.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links