services / Azure / Kubernetes group impersonation (Arc-connected cluster)

The Kubernetes impersonate verb on group identities for an Azure Arc-connected cluster. It allows the holder to assert arbitrary group memberships (via Impersonate-Group headers) when making API requests, inheriting the RBAC bound to those groups.

Impersonation is an identity-spoofing primitive: holding it on users/groups/userextras effectively grants the union of all identities' permissions, up to cluster-admin (system:masters). This is among the most powerful capabilities in a cluster.

Microsoft.​Kubernetes/​connectedClusters/​groups/​impersonate/​action

Group impersonation lets the holder assume membership in privileged groups such as system:masters, inheriting their RBAC for full privilege escalation and lateral movement.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links