services / Azure / Kubernetes secrets

Kubernetes Secret objects in an Azure Arc-connected cluster. Secrets store sensitive credential material such as service-account tokens, passwords, TLS private keys, registry credentials, and connection strings used by workloads.

Secret reads return raw credential material in cleartext, making this resource type a primary target for credential theft, identity takeover, and lateral movement.

Microsoft.​Kubernetes/​connectedClusters/​secrets/​write

Creating/updating secrets lets an attacker plant or overwrite credential material consumed by workloads, establishing persistent attacker-controlled credentials, enabling lateral movement, and poisoning trusted secrets.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links