Vulnerability · Published Oct 9, 2025 · Assigned by redhat

CVE-2025-11561Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

High 8.8

In plain English

A high-severity privilege mismanagement in sssd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	libipa_hbac	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libipa_hbac	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_autofs	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_autofs	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_certmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_certmap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_idmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_idmap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_nss_idmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_nss_idmap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_nss_idmap-devel	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_nss_idmap-devel	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_simpleifp	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_simpleifp	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	libsss_sudo	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	libsss_sudo	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	python3-libipa_hbac	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	python3-libipa_hbac	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	python3-libsss_nss_idmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	python3-libsss_nss_idmap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	python3-sss	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	python3-sss	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	python3-sss-murmur	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	python3-sss-murmur	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:10	python3-sssdconfig	2.11.1-2.el10_1.1	ALSA-2025:21020
AlmaLinux:8	python3-sssdconfig	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	python3-sssdconfig	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-ad	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-ad	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-client	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-client	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-common	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-common	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-common-pac	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-common-pac	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-dbus	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-dbus	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-idp	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-idp	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-ipa	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-ipa	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-kcm	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-kcm	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-krb5	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-krb5	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-krb5-common	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-krb5-common	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-ldap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-ldap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-nfs-idmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-nfs-idmap	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:9	sssd-passkey	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-polkit-rules	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-polkit-rules	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-proxy	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-proxy	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-tools	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-tools	2.9.7-4.el9_7.1	ALSA-2025:20954
AlmaLinux:8	sssd-winbind-idmap	2.9.4-5.el8_10.3	ALSA-2025:19610
AlmaLinux:9	sssd-winbind-idmap	2.9.7-4.el9_7.1	ALSA-2025:20954
Debian:12	sssd	no fix listed	DEBIAN-CVE-2025-11561
Debian:13	sssd	no fix listed	DEBIAN-CVE-2025-11561
Rocky Linux:10	sssd	0:2.11.1-2.el10_1.1	RLSA-2025:21020
Rocky Linux:8	sssd	0:2.9.4-5.el8_10.3	RLSA-2025:19610
Rocky Linux:9	sssd	0:2.9.7-4.el9_7.1	RLSA-2025:20954
Ubuntu:22.04:LTS	sssd	no fix listed	UBUNTU-CVE-2025-11561
Ubuntu:24.04:LTS	sssd	no fix listed	UBUNTU-CVE-2025-11561
Ubuntu:25.10	sssd	no fix listed	UBUNTU-CVE-2025-11561

Affected products (as reported)

Vendor	Product	Versions
	sssd	0 – through 2.11.1
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.19	see references
Red Hat	Red Hat OpenShift Container Platform 4.20	see references
Red Hat	Red Hat Ceph Storage 7	see references

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2025:19610 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19847 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19848 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19849 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19850 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19851 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19852 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19853 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19854 vendor-advisory, x_refsource_REDHAT
RHSA-2025:19859 vendor-advisory, x_refsource_REDHAT
RHSA-2025:20954 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21020 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21067 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21329 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21795 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22256 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22265 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22277 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22529 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22548 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22724 vendor-advisory, x_refsource_REDHAT
RHSA-2025:23113 vendor-advisory, x_refsource_REDHAT
RHSA-2026:0316 vendor-advisory, x_refsource_REDHAT
RHSA-2026:0677 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-11561 vdb-entry, x_refsource_REDHAT
https://blog.async.sg/kerberos-ldr
RHBZ#2402727 issue-tracking, x_refsource_REDHAT
https://github.com/SSSD/sssd/issues/8021