SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems
CVE: CVE-2025-11561
Component: sssd
CWE: CWE-269
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-09T00:00:00+00:00

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Statement: The Red Hat Product Security team has assessed this issue as High severity for domain-joined Linux systems using default SSSD configurations. While the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled by default, fallback to the an2ln plugin can occur, allowing a domain user who can modify certain Active Directory attributes (such as userPrincipalName or samAccountName) to map to privileged local accounts. This could lead to unauthorized access or elevated privileges on affected Linux hosts. Administrators are advised to review and apply recommended hardening configurations to mitigate this behavior.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:9ea794d2dd24ff7377534edfb0447e5398a28919a84300cc79fe7bb8ae550d1b

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:b373f9055bf22079e7baf0c7b3ea21067248932bb0ec57fa0af30c51810bbe91

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:1a02fd2ae00143baf6432510ede55f9add8779973b07c1e5fe6c9036f008f2da

      (For s390x architecture)
      The image digest is sha256:384e9567b30f4d74e103f672f3587d17e1b1484dda0d65d6a5092740a5a793a9

      (For ppc64le architecture)
      The image digest is sha256:079c50cdefecb2ee75126dceda39cca953f46c8ecd4fb4c877af7ccbe31c48bb

      (For aarch64 architecture)
      The image digest is sha256:9b97c2081fcbca625d6066fbf86e665d1c29ba9be3932d721afb2f2b021daf51

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:39236e073ff4b62406a472178263fd2220b0f544c3fd26036120b470596fa255

      (For s390x architecture)
      The image digest is sha256:f94d7fce531623dd0d1d4b5fe1c299eba7152676306ed2e9ea3c7fe17b4ad5ee

      (For ppc64le architecture)
      The image digest is sha256:5cdc5d1a0cb3b990afbaa8d1559abf87d9194c375541f27689aa974c1336d9eb

      (For aarch64 architecture)
      The image digest is sha256:584bb60432b0460d97b9624a3cb1c625469534ac44dedb618f14834161c2d448

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5efb10e511ff6623fee08dd8cfa8915b9be5cc3b7f7501731ddc13fa0d2ea988

      (For s390x architecture)
      The image digest is sha256:2b77c206c6ab23808a1b3988f7e87f4dae14dbc57bf300e1ce1eabc945667b64

      (For ppc64le architecture)
      The image digest is sha256:6cbdd40976744d791db379a0c6d1a4203a17cf0f31a865e19916025647b7244a

      (For aarch64 architecture)
      The image digest is sha256:c71acfbc01a33e3cce8f02f3f2354409c3a00bfdaa46f0b4f53ac8ee8e763d8a

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:4f7b8774832b0928a98ffc519637a6e1e4fe085754a0e9d240104993f7ce940b

      (For s390x architecture)
      The image digest is sha256:fe6abf197b86cae6a7346a8564efb809d5192341ae1c63fd0a07980399b69173

      (For ppc64le architecture)
      The image digest is sha256:eb371d1bef44af03c7bb53e5ee994e02e88129814331d2d1cfe5d1a207389510

      (For aarch64 architecture)
      The image digest is sha256:bc53841307c98fb7b0585d708835311253396a20900a533d6b34800d1587d561

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:8c885ea0b3c5124989f0a9b93eba98eb9fca6bbd0262772d85d90bf713a4d572

      (For s390x architecture)
      The image digest is sha256:d0c9986fa3f054dc1f97289ee8869ec874ae191e86bf26c99c9ff0d945a09daa

      (For ppc64le architecture)
      The image digest is sha256:9f37a92c84e0e89378b1917cf3798331a39ef8f372169d985c1e2e48fbebba5f

      (For aarch64 architecture)
      The image digest is sha256:a6eefbbea0e6142de87f9894df435c433fe8153b9c522ab81ce28e3667de885d

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:90a6c7e4e570bd1914578a2b5b6c9847a2b877c466e29c97e75f28de73228a3b

      (For s390x architecture)
      The image digest is sha256:5484ec044fedf369ec502a8ce5b643e47a87df7c2acfc924bde61335ff274734

      (For ppc64le architecture)
      The image digest is sha256:429b7ef8f71f9f692163101e8d3edf53760dcd779918ec8f86fdf2a29899e0f7

      (For aarch64 architecture)
      The image digest is sha256:05675b270fe594e87b84f52802935a0907f100593fa40726f8c4e161593cc922

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.20 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:a29bcbc9f286d68b394ffa0288c5de7e487c90077c06cbaf7a4cadeb0398ce28

      (For s390x architecture)
      The image digest is sha256:724ea94541fa32defeae6a782fb2f1194e5bd7221ec33d7bcc6c4dc1e53cabc3

      (For ppc64le architecture)
      The image digest is sha256:125ba716fa99fd8dbf33a8407030ad06704cd394dfc4898f7d6fb69e1bc9a8cd

      (For aarch64 architecture)
      The image digest is sha256:38a6732d5a3485f145657156e3c0625c21aa0af16c49959dd97eec75bfb1706e

All OpenShift Container Platform 4.20 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
To mitigate this issue, ensure the SSSD Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is configured and the an2ln plugin is disabled by adding "disable = an2ln" in a krb5 include file, for example /var/lib/sss/pubconf/krb5.include.d/localauth_plugin and make sure it is included in the Kerberos configuration. Apply vendor updates and follow Red Hat guidance for SSSD hardening.