services / Azure / Kubernetes secrets

Kubernetes Secret objects in an Azure Arc-connected cluster. Secrets store sensitive credential material such as service-account tokens, passwords, TLS private keys, registry credentials, and connection strings used by workloads.

Secret reads return raw credential material in cleartext, making this resource type a primary target for credential theft, identity takeover, and lateral movement.

Microsoft.​Kubernetes/​connectedClusters/​secrets/​read

Data-plane read returns the actual secret material (service-account tokens, keys, passwords, connection strings), enabling credential exfiltration, lateral movement via the disclosed identities, and account takeover.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links