Introduction
Attackers with delegated permissions in Active Directory can gain unauthorized access to privileged Linux accounts without ever knowing their passwords. CVE-2025-11561 is a serious gap in how Linux systems that join Active Directory through SSSD handle Kerberos principal mapping, and it may enable privilege escalation across enterprise environments [1][4].
SSSD (System Security Services Daemon) is a core component of Linux-Active Directory integration in enterprise environments. It is widely used in Red Hat Enterprise Linux and other major distributions, where it handles centralized authentication and identity management. Microsoft Active Directory is the dominant enterprise directory service and is used by the majority of large organizations worldwide. Cross-platform authentication and access control in these organizations depend on the two working together.
Technical information
CVE-2025-11561 comes from SSSD's default configuration for Active Directory integration. The sssd_krb5_localauth_plugin, which securely maps Kerberos principals to local user names, is not enabled by default [2]. Without it, SSSD and the underlying Kerberos libraries fall back to the default principal-to-local name mapping. That logic typically strips the realm from the Kerberos principal (for example, [email protected] becomes admin), and attackers can manipulate it.
An attacker with permission to modify the userPrincipalName or samAccountName attributes in Active Directory can set them on an account they control to match a privileged user, such as a Linux administrator. When the attacker then authenticates to a Linux system with Kerberos, the missing local authorization plugin lets the principal map directly to the privileged local account. The result is unauthorized access or privilege escalation [1][4][7].
SSSD's default configuration is vulnerable unless the sssd_krb5_localauth_plugin is explicitly enabled in the Kerberos configuration. SSSD writes a configuration snippet for the plugin into its public Kerberos configuration snippet directory, but administrators must make sure the active Kerberos configuration (typically /etc/krb5.conf) includes that directory [2][5].
The root cause is improper privilege management (CWE-269), which comes from the insecure default principal mapping that applies when the plugin is not active [6]. To exploit the flaw, an attacker must already have permission to modify the relevant AD attributes. That is a common situation in environments with delegated administration [7].
Affected systems and versions
CVE-2025-11561 affects Linux systems that use SSSD to integrate with Microsoft Active Directory, specifically when the sssd_krb5_localauth_plugin is not enabled in the Kerberos configuration. Default SSSD configurations across major distributions, including Red Hat Enterprise Linux, are vulnerable unless the plugin is explicitly activated [1][2][5].
Affected configurations:
- Any Linux system using SSSD for AD integration where the sssd_krb5_localauth_plugin is not enabled
- Default deployments of SSSD as packaged by Red Hat and other vendors
- All SSSD versions where this plugin is not enabled by default (no specific version range is provided in public sources)
Vendor security history
Red Hat maintains SSSD as part of its supported enterprise Linux distributions. Earlier research found privilege separation problems in SSSD, including escalation paths through helper binaries [9]. The SSSD project is actively maintained, and Red Hat coordinates vulnerability disclosures and documentation updates. For CVE-2025-11561, the vendor responded with documentation and configuration guidance instead of a code patch, because the issue is considered a configuration hardening requirement [1][9].
