CVE-2025-11561: Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems
A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssdkrb5localauthplugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
Other sources
Improper Authorization configuration vulnerability in the System Security Services Daemon (SSSD) when integrated with Microsoft Active Directory. The flaw arises because, by default, the Kerberos local authentication plugin (sssdkrb5localauthplugin) is not enabled, allowing incorrect mapping of Kerberos principals to local users. An attacker with the ability to modify Active Directory attributes (userPrincipalName or samAccountName) can impersonate privileged accounts such as root or Administrator. This can lead to privilege escalation on domain-joined Linux systems using GSSAPI or password-based authentication.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11561?
CVE-2025-11561 is considered a high-severity vulnerability due to its potential to allow unauthorized local authentication access.
How do I fix CVE-2025-11561?
To fix CVE-2025-11561, ensure that the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled in SSSD configurations.
Which systems are affected by CVE-2025-11561?
CVE-2025-11561 affects Linux systems integrated with Microsoft Active Directory using the System Security Services Daemon (SSSD).
What types of attacks can CVE-2025-11561 enable?
CVE-2025-11561 may enable attackers to bypass normal authentication processes, potentially allowing unauthorized access to system resources.
Is there a workaround for CVE-2025-11561 if a patch is not yet available?
A potential workaround for CVE-2025-11561 is to manually configure SSSD to utilize the Kerberos local authentication plugin until an official patch is released.