Skip to content
Fencer Vulns
high 8.8

CVE-2025-11561 json

Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

published 2025-10-09 13 mo ago modified 2026-11-04 4 d ago also EUVD-2025-33347

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:2.10.2-3.el10_0.3, 0:2.11.1-2.el10_1.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.16.5-10.el7_9.17
  • Red Hat Red Hat Enterprise Linux 8 0:2.9.4-5.el8_10.3
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.2.3-20.el8_2.3
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.4.0-9.el8_4.4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.4.0-9.el8_4.4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.6.2-4.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:2.6.2-4.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:2.6.2-4.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.8.2-4.el8_8.3
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.8.2-4.el8_8.3
  • Red Hat Red Hat Enterprise Linux 9 0:2.9.7-4.el9_7.1
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:2.6.2-4.el9_0.4
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.8.2-5.el9_2.6
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:2.9.4-6.el9_4.4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.9.6-4.el9_6.3
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202601061735-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202601130113-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202511122212-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202512100122-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202512030118-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202511260612-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202511170715-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202511252219-0
  • Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202511252309-0
  • Red Hat Red Hat Ceph Storage 7 7
  • Red Hat Red Hat Ceph Storage 8 8
  • sssd Debian 14 2.12.0-1

debian advisories DEBIAN-CVE-2025-11561

  • sssd RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-ad RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-idp RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-ipa RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-kcm RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-dbus RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-krb5 RHEL 10.1 2.11.1-2.el10_1.1
  • sssd-ldap RHEL 10.1 2.11.1-2.el10_1.1

red hat advisories RHSA-2025:21067RHSA-2025:21020RHSA-2025:20954RHSA-2025:19851RHSA-2025:19859RHSA-2025:19854

  • sssd SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.9.5-160000.3.1
  • sssd Linux Micro 6.0 2.8.2-7.1
  • sssd Linux Micro 6.1 2.9.5-slfo.1.1_4.1
  • sssd SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.9.3-150600.3.28.1
  • sssd SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +2 more 1.16.1-150300.23.56.1
  • sssd SLE Module for Basesystem 15 SP7 2.9.3-150700.9.9.1
  • sssd SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 2.5.2-150500.10.39.1
  • sssd SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +5 more 2.5.2-150400.4.40.1

suse advisories SUSE-SU-2026:20014-1SUSE-SU-2026:20019-1SUSE-SU-2025:21084-1SUSE-SU-2025:21066-1SUSE-SU-2025:4247-1SUSE-SU-2025:4232-1

  • sssd openSUSE Leap 16.0 2.9.5-160000.3.1
  • sssd openSUSE Tumbleweed 2.11.1-2.1

opensuse advisories openSUSE-SU-2026:20001-1openSUSE-SU-2025:15751-1

  • sssd AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-ad AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-idp AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-ipa AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-kcm AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-dbus AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-krb5 AlmaLinux 9 2.9.7-4.el9_7.1
  • sssd-ldap AlmaLinux 9 2.9.7-4.el9_7.1

almalinux advisories ALSA-2025:20954ALSA-2025:21020ALSA-2025:19610

  • sssd Rocky Linux 10 2.11.1-2.el10_1.1
  • sssd Rocky Linux 9 2.9.7-4.el9_7.1
  • sssd Rocky Linux 8 2.9.4-5.el8_10.3

rocky linux advisories RLSA-2025:21020RLSA-2025:20954RLSA-2025:19610

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11561 updated cvss 8.8

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

  • Red Hat Enterprise Linux 6 sssd, sssd-ad, sssd-ipa, sssd-dbus, sssd-krb5, sssd-ldap, +19 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7 rhceph
    fixed: vendor fix RHSA-2025:22529
  • Red Hat Ceph Storage 8 rhceph
    fixed: vendor fix RHSA-2025:22548
  • Red Hat CodeReady Linux Builder EUS (v.9.4) sssd-debuginfo 2.9.4-6.el9_4.4, sssd-debugsource 2.9.4-6.el9_4.4, sssd-ad-debuginfo 2.9.4-6.el9_4.4, sssd-idp-debuginfo 2.9.4-6.el9_4.4, sssd-ipa-debuginfo 2.9.4-6.el9_4.4, sssd-kcm-debuginfo 2.9.4-6.el9_4.4, +24 more
    fixed: vendor fix RHSA-2025:19852
  • Red Hat CodeReady Linux Builder EUS (v.9.6) sssd-debuginfo 2.9.6-4.el9_6.3, sssd-debugsource 2.9.6-4.el9_6.3, sssd-ad-debuginfo 2.9.6-4.el9_6.3, sssd-idp-debuginfo 2.9.6-4.el9_6.3, sssd-ipa-debuginfo 2.9.6-4.el9_6.3, sssd-kcm-debuginfo 2.9.6-4.el9_6.3, +24 more
    fixed: vendor fix RHSA-2025:21067
  • Red Hat Enterprise Linux AppStream (v. 8) sssd-idp 2.9.4-5.el8_10.3
    fixed: vendor fix RHSA-2025:19610
  • Red Hat Enterprise Linux AppStream (v. 9) sssd-idp 2.9.7-4.el9_7.1
    fixed: vendor fix RHSA-2025:20954
  • Red Hat Enterprise Linux AppStream (v. 10) sssd-idp 2.10.2-3.el10_0.3, sssd-idp 2.11.1-2.el10_1.1
    fixed: vendor fix RHSA-2025:19851
show 30 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) sssd-idp 2.8.2-4.el8_8.3
    fixed: vendor fix RHSA-2025:19853
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) sssd-idp 2.8.2-5.el9_2.6
    fixed: vendor fix RHSA-2025:19854
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) sssd-idp 2.9.4-6.el9_4.4
    fixed: vendor fix RHSA-2025:19852
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) sssd-idp 2.9.6-4.el9_6.3
    fixed: vendor fix RHSA-2025:21067
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) sssd-idp 2.8.2-4.el8_8.3
    fixed: vendor fix RHSA-2025:19853
  • Red Hat Enterprise Linux BaseOS (v. 8) sssd 2.9.4-5.el8_10.3, sssd-ad 2.9.4-5.el8_10.3, sssd-ipa 2.9.4-5.el8_10.3, sssd-kcm 2.9.4-5.el8_10.3, sssd-dbus 2.9.4-5.el8_10.3, sssd-krb5 2.9.4-5.el8_10.3, +22 more
    fixed: vendor fix RHSA-2025:19610
  • Red Hat Enterprise Linux BaseOS (v. 9) sssd 2.9.7-4.el9_7.1, sssd-ad 2.9.7-4.el9_7.1, sssd-ipa 2.9.7-4.el9_7.1, sssd-kcm 2.9.7-4.el9_7.1, sssd-dbus 2.9.7-4.el9_7.1, sssd-krb5 2.9.7-4.el9_7.1, +23 more
    fixed: vendor fix RHSA-2025:20954
  • Red Hat Enterprise Linux BaseOS (v. 10) sssd 2.10.2-3.el10_0.3, sssd 2.11.1-2.el10_1.1, sssd-ad 2.10.2-3.el10_0.3, sssd-ad 2.11.1-2.el10_1.1, sssd-ipa 2.10.2-3.el10_0.3, sssd-ipa 2.11.1-2.el10_1.1, +48 more
    fixed: vendor fix RHSA-2025:19851
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) sssd 2.2.3-20.el8_2.3, sssd-ad 2.2.3-20.el8_2.3, sssd-ipa 2.2.3-20.el8_2.3, sssd-kcm 2.2.3-20.el8_2.3, sssd-dbus 2.2.3-20.el8_2.3, sssd-krb5 2.2.3-20.el8_2.3, +23 more
    fixed: vendor fix RHSA-2025:19859
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) sssd 2.4.0-9.el8_4.4, sssd-ad 2.4.0-9.el8_4.4, sssd-ipa 2.4.0-9.el8_4.4, sssd-kcm 2.4.0-9.el8_4.4, sssd-dbus 2.4.0-9.el8_4.4, sssd-krb5 2.4.0-9.el8_4.4, +23 more
    fixed: vendor fix RHSA-2025:19848
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) sssd 2.6.2-4.el8_6.4, sssd-ad 2.6.2-4.el8_6.4, sssd-ipa 2.6.2-4.el8_6.4, sssd-kcm 2.6.2-4.el8_6.4, sssd-dbus 2.6.2-4.el8_6.4, sssd-krb5 2.6.2-4.el8_6.4, +22 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) sssd 2.6.2-4.el8_6.4, sssd-ad 2.6.2-4.el8_6.4, sssd-ipa 2.6.2-4.el8_6.4, sssd-kcm 2.6.2-4.el8_6.4, sssd-dbus 2.6.2-4.el8_6.4, sssd-krb5 2.6.2-4.el8_6.4, +22 more
    fixed: vendor fix RHSA-2025:19849
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) sssd 2.8.2-4.el8_8.3, sssd-ad 2.8.2-4.el8_8.3, sssd-ipa 2.8.2-4.el8_8.3, sssd-kcm 2.8.2-4.el8_8.3, sssd-dbus 2.8.2-4.el8_8.3, sssd-krb5 2.8.2-4.el8_8.3, +22 more
    fixed: vendor fix RHSA-2025:19853
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) sssd 2.6.2-4.el9_0.4, sssd-ad 2.6.2-4.el9_0.4, sssd-ipa 2.6.2-4.el9_0.4, sssd-kcm 2.6.2-4.el9_0.4, sssd-dbus 2.6.2-4.el9_0.4, sssd-krb5 2.6.2-4.el9_0.4, +22 more
    fixed: vendor fix RHSA-2025:19850
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) sssd 2.8.2-5.el9_2.6, sssd-ad 2.8.2-5.el9_2.6, sssd-ipa 2.8.2-5.el9_2.6, sssd-kcm 2.8.2-5.el9_2.6, sssd-dbus 2.8.2-5.el9_2.6, sssd-krb5 2.8.2-5.el9_2.6, +22 more
    fixed: vendor fix RHSA-2025:19854
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) sssd 2.9.4-6.el9_4.4, sssd-ad 2.9.4-6.el9_4.4, sssd-ipa 2.9.4-6.el9_4.4, sssd-kcm 2.9.4-6.el9_4.4, sssd-dbus 2.9.4-6.el9_4.4, sssd-krb5 2.9.4-6.el9_4.4, +23 more
    fixed: vendor fix RHSA-2025:19852
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) sssd 2.9.6-4.el9_6.3, sssd-ad 2.9.6-4.el9_6.3, sssd-ipa 2.9.6-4.el9_6.3, sssd-kcm 2.9.6-4.el9_6.3, sssd-dbus 2.9.6-4.el9_6.3, sssd-krb5 2.9.6-4.el9_6.3, +23 more
    fixed: vendor fix RHSA-2025:21067
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) sssd 2.4.0-9.el8_4.4, sssd-ad 2.4.0-9.el8_4.4, sssd-ipa 2.4.0-9.el8_4.4, sssd-kcm 2.4.0-9.el8_4.4, sssd-dbus 2.4.0-9.el8_4.4, sssd-krb5 2.4.0-9.el8_4.4, +23 more
    fixed: vendor fix RHSA-2025:19848
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) sssd 2.6.2-4.el8_6.4, sssd-ad 2.6.2-4.el8_6.4, sssd-ipa 2.6.2-4.el8_6.4, sssd-kcm 2.6.2-4.el8_6.4, sssd-dbus 2.6.2-4.el8_6.4, sssd-krb5 2.6.2-4.el8_6.4, +22 more
    fixed: vendor fix RHSA-2025:19849
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) sssd 2.8.2-4.el8_8.3, sssd-ad 2.8.2-4.el8_8.3, sssd-ipa 2.8.2-4.el8_8.3, sssd-kcm 2.8.2-4.el8_8.3, sssd-dbus 2.8.2-4.el8_8.3, sssd-krb5 2.8.2-4.el8_8.3, +22 more
    fixed: vendor fix RHSA-2025:19853
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) sssd-debuginfo 2.9.7-4.el9_7.1, sssd-debugsource 2.9.7-4.el9_7.1, sssd-ad-debuginfo 2.9.7-4.el9_7.1, sssd-idp-debuginfo 2.9.7-4.el9_7.1, sssd-ipa-debuginfo 2.9.7-4.el9_7.1, sssd-kcm-debuginfo 2.9.7-4.el9_7.1, +24 more
    fixed: vendor fix RHSA-2025:20954
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) sssd-debuginfo 2.10.2-3.el10_0.3, sssd-debuginfo 2.11.1-2.el10_1.1, sssd-debugsource 2.10.2-3.el10_0.3, sssd-debugsource 2.11.1-2.el10_1.1, sssd-ad-debuginfo 2.10.2-3.el10_0.3, sssd-ad-debuginfo 2.11.1-2.el10_1.1, +52 more
    fixed: vendor fix RHSA-2025:19851
  • Red Hat Enterprise Linux CRB (v. 8) sssd-debuginfo 2.9.4-5.el8_10.3, sssd-debugsource 2.9.4-5.el8_10.3, sssd-ad-debuginfo 2.9.4-5.el8_10.3, sssd-idp-debuginfo 2.9.4-5.el8_10.3, sssd-ipa-debuginfo 2.9.4-5.el8_10.3, sssd-kcm-debuginfo 2.9.4-5.el8_10.3, +23 more
    fixed: vendor fix RHSA-2025:19610
  • Red Hat Enterprise Linux Server (v. 7 ELS) sssd 1.16.5-10.el7_9.17, sssd-ad 1.16.5-10.el7_9.17, sssd-ipa 1.16.5-10.el7_9.17, sssd-kcm 1.16.5-10.el7_9.17, sssd-dbus 1.16.5-10.el7_9.17, sssd-krb5 1.16.5-10.el7_9.17, +22 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-libsss_nss_idmap 1.16.5-10.el7_9.17
    fixed: vendor fix RHSA-2025:19847
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202601061735
    fixed: vendor fix RHSA-2026:0316
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202601130113
    fixed: vendor fix RHSA-2026:0677
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202511122212
    fixed: vendor fix RHSA-2025:21329
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202512100122
    fixed: vendor fix RHSA-2025:23113
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202512030118
    fixed: vendor fix RHSA-2025:22724
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202511260612
    fixed: vendor fix RHSA-2025:22265
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202511170715
    fixed: vendor fix RHSA-2025:21795

2 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12 mo ago

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat Ceph Storage 7
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.