Publicly accessible Azure Container App has an assigned managed identity that can escalate privileges to obtain administrator-equivalent RBAC rights

azure

Description

A publicly accessible Azure Container App has an assigned managed identity that can escalate privileges to obtain administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. If the container app is compromised, an attacker could use the associated managed identity to escalate privileges and control resources and security settings within that scope.

Remediation

  1. Restrict public network access to the container app by using internal ingress or IP ingress restrictions. See Configure ingress for Azure Container Apps.
  2. Remove unnecessary privilege-escalation permissions from the managed identity and grant only the permissions required by the workload. See Remove Azure role assignments.