services / Azure / Kubernetes cluster role bindings (Arc-connected cluster)

ClusterRoleBindings are Kubernetes RBAC objects in an Azure Arc-connected cluster that bind subjects (users, groups, service accounts) to cluster-wide ClusterRoles, including cluster-admin, governing cluster-wide authorization.

These are the cluster's primary cluster-wide access-control grants; writing them is the canonical Kubernetes privilege-escalation path.

Microsoft.​Kubernetes/​connectedClusters/​rbac.​authorization.​k8s.​io/​clusterrolebindings/​delete

Deleting ClusterRoleBindings removes cluster-wide RBAC grants, destroying access-control policy (which can strip away grants that would otherwise deny the attacker) and revoking other principals'/admins' authorized access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links