Riskcovery

CVE-2025-11561

Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

State
Published
Severity
8.8 High
Published
Oct 9, 2025
Updated
Aug 31, 2026
Reserved
Oct 9, 2025

Read the record on cve.org

Description

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-269 Improper Privilege Management

Affected Products

ProductVersions
sssd
  • 2.11.1 and earlierAffected
Red Hat Enterprise Linux 10Red Hat
  • 0:2.10.2-3.el10_0.3 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
  • 0:2.11.1-2.el10_1.1 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:1.16.5-10.el7_9.17 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:2.9.4-5.el8_10.3 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:2.9.4-5.el8_10.3 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:2.2.3-20.el8_2.3 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:2.4.0-9.el8_4.4 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat
  • 0:2.4.0-9.el8_4.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 0:2.6.2-4.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 0:2.6.2-4.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 0:2.6.2-4.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 0:2.8.2-4.el8_8.3 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 0:2.8.2-4.el8_8.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:2.9.7-4.el9_7.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:2.9.7-4.el9_7.1 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:2.6.2-4.el9_0.4 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:2.8.2-5.el9_2.6 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:2.9.4-6.el9_4.4 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat
  • 0:2.9.6-4.el9_6.3 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat
  • 412.86.202601061735-0 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat
  • 413.92.202601130113-0 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 414.92.202511122212-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 415.92.202512100122-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 416.94.202512030118-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat
  • 417.94.202511260612-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 418.94.202511170715-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 4.19.9.6.202511252219-0 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat
  • 4.20.9.6.202511252309-0 and laterNot affected
Red Hat Ceph Storage 7Red Hat
  • 7 and laterNot affected
Red Hat Ceph Storage 8Red Hat
  • 8 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat OpenShift Container Platform 4Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.