services / Azure / AKS managed cluster

An Azure Kubernetes Service (AKS) managed cluster: the control-plane resource that hosts a Kubernetes cluster, its node pools, networking, RBAC/Azure AD integration, and a managed/service-principal identity used to act on Azure resources.

AKS clusters are production compute assets that run workloads, hold in-cluster secrets, and act through a cluster identity; credential-listing and command-execution operations on them are effectively cluster-admin grade and warrant CRITICAL scope.

Microsoft.​ContainerService/​managedClusters/​resetAADProfile/​action

Resets the cluster's Azure AD integration/admin-group bindings, letting an attacker designate AAD groups they control as cluster admins, lock out legitimate operators, and weaken the authentication defense.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)
3. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links