services / Azure / Azure Arc connected-cluster Kubernetes pods

Pod objects in the Kubernetes data plane of an Azure Arc-enabled (connected) cluster, representing running workload instances, their container specs, images, environment, mounted volumes/secret references, and service-account bindings.

Pods are the unit of cluster code execution; creating pods or exec'ing into them can run arbitrary code, assume service-account identities, and reach mounted secrets and data, making write/exec on pods effectively cluster code execution.

Microsoft.​Kubernetes/​connectedClusters/​pods/​exec/​action

Exec grants an interactive shell inside a running container, allowing the attacker to run arbitrary code as the pod's identity, read in-container data and mounted secrets/service-account tokens (lateral movement), and exfiltrate data.

Risks

1. Data exfiltration (CRITICAL)
2. Lateral movement (BOOST)
3. Resource hijacking (MEDIUM)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links