azure-dbx-pipeline-update
CAN_MANAGE on a Delta Live Tables pipeline allows repointing the notebook/library source, injecting attacker code.
match (effective permission)
{
"action": "databricks:pipelines:update",
"scope_type": "pipeline"
}
where
principal has Databricks CAN_MANAGE permission on the target DLT pipeline (PUT /api/2.0/pipelines/{id})
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <Databricks DLT Pipeline (BatchJob)> |
| permissions | databricks:pipelines:update (CAN_MANAGE on the pipeline — PUT /api/2.0/pipelines/{id}) |
| conditions | trigger_exists |
Narrative
{principal.name} can update Delta Live Tables pipeline {target.name} (CAN_MANAGE, /api/2.0/pipelines), injecting attacker code that runs as its cluster MI on the next pipeline execution.
Raw rule rules/derived/azure/databricks.yaml
id: azure-dbx-pipeline-update
emits: CanModifyCode
description: CAN_MANAGE on a Delta Live Tables pipeline allows repointing the notebook/library source,
injecting attacker code.
match_effective_permission:
action: databricks:pipelines:update
scope_type: pipeline
where:
- principal has Databricks CAN_MANAGE permission on the target DLT pipeline (PUT /api/2.0/pipelines/{id})
emit:
source_type: Identity
source: <principal>
target: <Databricks DLT Pipeline (BatchJob)>
permissions:
- "databricks:pipelines:update (CAN_MANAGE on the pipeline \u2014 PUT /api/2.0/pipelines/{id})"
conditions:
- trigger_exists
escalation: Repoint the pipeline notebook source to attacker-controlled code; on next pipeline run (continuous
or triggered) executes as the pipeline cluster MI.
false_positive_note: DLT pipelines run on dedicated clusters; the cluster must have an Access Connector
MI or cluster-level MI for escalation. Without an MI, execution yields only data access via explicit
credentials. CONDITIONAL(trigger_exists) when the pipeline is not in continuous mode and no trigger
exists.
narrative: '{principal.name} can update Delta Live Tables pipeline {target.name} (CAN_MANAGE, /api/2.0/pipelines),
injecting attacker code that runs as its cluster MI on the next pipeline execution.'