CVE-2025-11561 Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems
Attackers with AD attribute modification rights can impersonate privileged users via SSSD Kerberos fallback, leading to privilege escalation on domain-joined Linux systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11561?
CVE-2025-11561 is a high-severity vulnerability in Red Hat Ceph Storage 7, published on 9 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
Weakness: CWE-269
Which versions are affected by CVE-2025-11561?
Linux distribution packages (40)
python3-sssdconfig AlmaLinux:10 | All versions | 2.11.1-2.el10_1.1 |
libipa_hbac AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_autofs AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_certmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_idmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_nss_idmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_nss_idmap-devel AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_simpleifp AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libsss_sudo AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
python3-libipa_hbac AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
python3-libsss_nss_idmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
python3-sss AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
python3-sss-murmur AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
python3-sssdconfig AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-ad AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-client AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-common AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-common-pac AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-dbus AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-idp AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-ipa AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-kcm AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-krb5 AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-krb5-common AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-ldap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-nfs-idmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-polkit-rules AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-proxy AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-tools AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
sssd-winbind-idmap AlmaLinux:8 | All versions | 2.9.4-5.el8_10.3 |
libipa_hbac AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_autofs AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_certmap AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_idmap AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_nss_idmap AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_nss_idmap-devel AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_simpleifp AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
libsss_sudo AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
python3-libipa_hbac AlmaLinux:9 | All versions | 2.9.7-4.el9_7.1 |
How do I fix CVE-2025-11561?
Apply the vendor's patch.
Is CVE-2025-11561 being exploited?
There is no known exploitation of CVE-2025-11561 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:19610, ALSA-2025:20954, ALSA-2025:21020, CLSA-2025-1763371827, CLSA-2025-1763397525, CLSA-2025-1764028069 and 38 more.