A control-plane service manages or orchestrates how a system operates. Unlike a user-facing application, it handles tasks such as configuring workloads, coordinating resources, or issuing instructions to other components. In a sandbox, an internal control-plane endpoint may manage execution environments or their settings.
These services are sensitive because access can enable changes beyond the service itself. In attacks, a compromised workload may probe internal networks for control endpoints or attempt to use exposed credentials. Reaching an endpoint does not by itself grant control: authentication, token scope, and authorization determine what actions are allowed. Defenders should restrict network access, protect and narrowly scope credentials, and enforce authorization at the service, rather than relying on a single network rule.