Read the docs
TI-2025-10595 Aliases CVE-2025-11561GHSA-gj84-8vfx-q3vm

Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

Priority MEDIUM 42CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 41 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00823 57th percentileScored 2026-11-07
Fix Partial Red Hat: 24 advisoriesRed Hat: 41 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—sssdup to 2.11.1—No fix listedCNA
Red HatRed Hat Enterprise Linux 10—2.10.2-3.el10_0.3Patch availableCNA
Red HatRed Hat Enterprise Linux 10—2.11.1-2.el10_1.1Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—1.16.5-10.el7_9.17Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.9.4-5.el8_10.3Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.9.4-5.el8_10.3Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—2.2.3-20.el8_2.3Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—2.4.0-9.el8_4.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—2.4.0-9.el8_4.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—2.6.2-4.el8_6.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—2.6.2-4.el8_6.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—2.6.2-4.el8_6.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—2.8.2-4.el8_8.3Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—2.8.2-4.el8_8.3Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.9.7-4.el9_7.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.9.7-4.el9_7.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—2.6.2-4.el9_0.4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—2.8.2-5.el9_2.6Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—2.9.4-6.el9_4.4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—2.9.6-4.el9_6.3Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.12—412.86.202601061735-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.13—413.92.202601130113-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.14—414.92.202511122212-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.15—415.92.202512100122-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.16—416.94.202512030118-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.17—417.94.202511260612-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.18—418.94.202511170715-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.19—4.19.9.6.202511252219-0Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.20—4.20.9.6.202511252309-0Patch availableCNA
Red HatRed Hat Ceph Storage 7—7Patch availableCNA
Red HatRed Hat Ceph Storage 8—8Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • sssd Vendor— Affected up to 2.11.1 Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 2.10.2-3.el10_0.3 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 2.11.1-2.el10_1.1 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.16.5-10.el7_9.17 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.9.4-5.el8_10.3 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.9.4-5.el8_10.3 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 2.2.3-20.el8_2.3 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.4.0-9.el8_4.4 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 2.4.0-9.el8_4.4 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.6.2-4.el8_6.4 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.6.2-4.el8_6.4 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.6.2-4.el8_6.4 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.8.2-4.el8_8.3 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.8.2-4.el8_8.3 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.9.7-4.el9_7.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.9.7-4.el9_7.1 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.6.2-4.el9_0.4 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.8.2-5.el9_2.6 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2.9.4-6.el9_4.4 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.9.6-4.el9_6.3 Patch available CNA
  • Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 412.86.202601061735-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 413.92.202601130113-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 414.92.202511122212-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 415.92.202512100122-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 416.94.202512030118-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 417.94.202511260612-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 418.94.202511170715-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 4.19.9.6.202511252219-0 Patch available CNA
  • Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 4.20.9.6.202511252309-0 Patch available CNA
  • Red Hat Ceph Storage 7 VendorRed Hat Affected — Fixed in 7 Patch available CNA
  • Red Hat Ceph Storage 8 VendorRed Hat Affected — Fixed in 8 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 40

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.010.0—Red Hat
cpe:/o:redhat:enterprise_linux:10.110.1—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:8::crb8—Red Hat
cpe:/o:redhat:enterprise_linux:8::baseos8—Red Hat
cpe:/o:redhat:rhel_aus:8.2::baseos8.2—Red Hat
cpe:/o:redhat:rhel_aus:8.4::baseos8.4—Red Hat
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos8.4—Red Hat
cpe:/o:redhat:rhel_aus:8.6::baseos8.6—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:10.1 Versions 10.1 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::crb Versions 8 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.2::baseos Versions 8.2 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.4::baseos Versions 8.4 — ·Red Hat
  • cpe:/o:redhat:rhel_eus_long_life:8.4::baseos Versions 8.4 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
Show 30 more CPE
CPEVersionsRoleVendor
cpe:/o:redhat:rhel_e4s:8.6::baseos8.6—Red Hat
cpe:/o:redhat:rhel_tus:8.6::baseos8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
cpe:/o:redhat:rhel_e4s:8.8::baseos8.8—Red Hat
cpe:/o:redhat:rhel_tus:8.8::baseos8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:enterprise_linux:9::crb9—Red Hat
cpe:/o:redhat:enterprise_linux:9::baseos9—Red Hat
cpe:/o:redhat:rhel_e4s:9.0::baseos9.0—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/o:redhat:rhel_e4s:9.2::baseos9.2—Red Hat
cpe:/a:redhat:rhel_eus:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.4::crb9.4—Red Hat
cpe:/o:redhat:rhel_eus:9.4::baseos9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/a:redhat:rhel_eus:9.6::crb9.6—Red Hat
cpe:/o:redhat:rhel_eus:9.6::baseos9.6—Red Hat
cpe:/a:redhat:openshift:4.12::el84.12—Red Hat
cpe:/a:redhat:openshift:4.13::el94.13—Red Hat
cpe:/a:redhat:openshift:4.14::el94.14—Red Hat
cpe:/a:redhat:openshift:4.15::el94.15—Red Hat
cpe:/a:redhat:openshift:4.16::el94.16—Red Hat
cpe:/a:redhat:openshift:4.17::el94.17—Red Hat
cpe:/a:redhat:openshift:4.18::el94.18—Red Hat
cpe:/a:redhat:openshift:4.19::el94.19—Red Hat
cpe:/a:redhat:openshift:4.20::el94.20—Red Hat
cpe:/a:redhat:ceph_storage:7::el97—Red Hat
cpe:/a:redhat:ceph_storage:8::el98—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
  • cpe:/o:redhat:rhel_e4s:8.6::baseos Versions 8.6 — ·Red Hat
  • cpe:/o:redhat:rhel_tus:8.6::baseos Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
  • cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
  • cpe:/o:redhat:rhel_e4s:9.0::baseos Versions 9.0 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/o:redhat:rhel_e4s:9.2::baseos Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.4::crb Versions 9.4 — ·Red Hat
  • cpe:/o:redhat:rhel_eus:9.4::baseos Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::crb Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_eus:9.6::baseos Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
  • cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
  • cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
  • cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
  • cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
  • cpe:/a:redhat:openshift:4.17::el9 Versions 4.17 — ·Red Hat
  • cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
  • cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
  • cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
  • cpe:/a:redhat:ceph_storage:7::el9 Versions 7 — ·Red Hat
  • cpe:/a:redhat:ceph_storage:8::el9 Versions 8 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat

Remediation

Red Hat 24 advisories

  • RHSA-2026:0677 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202601130113-0
  • RHSA-2026:0316 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202601061735-0
  • RHSA-2025:23113 Released 2026-01-07 · Red Hat rating Important
    OpenShift Container Platform 4.15.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202512100122-0, rhcos-ppc64le-415.92.202512100122-0, rhcos-s390x-415.92.202512100122-0 +1
Show 21 more Red Hat advisories
  • RHSA-2025:22724 Released 2025-12-10 · Red Hat rating Important
    OpenShift Container Platform 4.16.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202512030118-0, rhcos-ppc64le-416.94.202512030118-0, rhcos-s390x-416.94.202512030118-0 +1
  • RHSA-2025:22277 Released 2025-12-03 · Red Hat rating Important
    OpenShift Container Platform 4.19.20 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202511252219-0, rhcos-ppc64le-4.19.9.6.202511252219-0, rhcos-s390x-4.19.9.6.202511252219-0 +1
  • RHSA-2025:22265 Released 2025-12-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202511260612-0, rhcos-ppc64le-417.94.202511260612-0, rhcos-s390x-417.94.202511260612-0 +1
  • RHSA-2025:22256 Released 2025-12-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.6 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202511252309-0, rhcos-ppc64le-4.20.9.6.202511252309-0, rhcos-s390x-4.20.9.6.202511252309-0 +1
  • RHSA-2025:22548 Released 2025-12-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9, registry.redhat.io/rhceph/rhceph-haproxy-rhel9
  • RHSA-2025:22529 Released 2025-12-01 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2025:21795 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.18.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202511170715-0, rhcos-ppc64le-418.94.202511170715-0, rhcos-s390x-418.94.202511170715-0 +1
  • RHSA-2025:21329 Released 2025-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202511122212-0, rhcos-ppc64le-414.92.202511122212-0, rhcos-s390x-414.92.202511122212-0 +1
  • RHSA-2025:21067 Released 2025-11-12 · Red Hat rating Important
    sssd security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) libsss_nss_idmap-devel-2.9.6-4.el9_6.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) sssd-idp-2.9.6-4.el9_6.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libipa_hbac-2.9.6-4.el9_6.3, libsss_autofs-2.9.6-4.el9_6.3, libsss_certmap-2.9.6-4.el9_6.3 +26
  • RHSA-2025:21020 Released 2025-11-11 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream (v. 10) sssd-idp-2.11.1-2.el10_1.1
    • Red Hat Enterprise Linux BaseOS (v. 10) libipa_hbac-2.11.1-2.el10_1.1, libsss_autofs-2.11.1-2.el10_1.1, libsss_certmap-2.11.1-2.el10_1.1 +24
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsss_nss_idmap-devel-2.11.1-2.el10_1.1
  • RHSA-2025:20954 Released 2025-11-11 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream (v. 9) sssd-idp-2.9.7-4.el9_7.1
    • Red Hat Enterprise Linux BaseOS (v. 9) libipa_hbac-2.9.7-4.el9_7.1, libsss_autofs-2.9.7-4.el9_7.1, libsss_certmap-2.9.7-4.el9_7.1 +26
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libsss_nss_idmap-devel-2.9.7-4.el9_7.1
  • RHSA-2025:19851 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream (v. 10) sssd-idp-2.10.2-3.el10_0.3
    • Red Hat Enterprise Linux BaseOS (v. 10) libipa_hbac-2.10.2-3.el10_0.3, libsss_autofs-2.10.2-3.el10_0.3, libsss_certmap-2.10.2-3.el10_0.3 +24
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsss_nss_idmap-devel-2.10.2-3.el10_0.3
  • RHSA-2025:19852 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) libsss_nss_idmap-devel-2.9.4-6.el9_4.4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) sssd-idp-2.9.4-6.el9_4.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libipa_hbac-2.9.4-6.el9_4.4, libsss_autofs-2.9.4-6.el9_4.4, libsss_certmap-2.9.4-6.el9_4.4 +26
  • RHSA-2025:19859 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libipa_hbac-2.2.3-20.el8_2.3, libsss_autofs-2.2.3-20.el8_2.3, libsss_certmap-2.2.3-20.el8_2.3 +26
  • RHSA-2025:19849 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libipa_hbac-2.6.2-4.el8_6.4, libsss_autofs-2.6.2-4.el8_6.4, libsss_certmap-2.6.2-4.el8_6.4 +25
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libipa_hbac-2.6.2-4.el8_6.4, libsss_autofs-2.6.2-4.el8_6.4, libsss_certmap-2.6.2-4.el8_6.4 +25
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libipa_hbac-2.6.2-4.el8_6.4, libsss_autofs-2.6.2-4.el8_6.4, libsss_certmap-2.6.2-4.el8_6.4 +25
  • RHSA-2025:19854 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) sssd-idp-2.8.2-5.el9_2.6
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libipa_hbac-2.8.2-5.el9_2.6, libsss_autofs-2.8.2-5.el9_2.6, libsss_certmap-2.8.2-5.el9_2.6 +25
  • RHSA-2025:19853 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) sssd-idp-2.8.2-4.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) sssd-idp-2.8.2-4.el8_8.3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libipa_hbac-2.8.2-4.el8_8.3, libsss_autofs-2.8.2-4.el8_8.3, libsss_certmap-2.8.2-4.el8_8.3 +25
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libipa_hbac-2.8.2-4.el8_8.3, libsss_autofs-2.8.2-4.el8_8.3, libsss_certmap-2.8.2-4.el8_8.3 +25
  • RHSA-2025:19848 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libipa_hbac-2.4.0-9.el8_4.4, libsss_autofs-2.4.0-9.el8_4.4, libsss_certmap-2.4.0-9.el8_4.4 +26
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libipa_hbac-2.4.0-9.el8_4.4, libsss_autofs-2.4.0-9.el8_4.4, libsss_certmap-2.4.0-9.el8_4.4 +26
  • RHSA-2025:19847 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libipa_hbac-1.16.5-10.el7_9.17, libipa_hbac-1.16.5-10.el7_9.17.ppc, libsss_autofs-1.16.5-10.el7_9.17 +31
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libipa_hbac-devel-1.16.5-10.el7_9.17, libipa_hbac-devel-1.16.5-10.el7_9.17.ppc, libsss_certmap-devel-1.16.5-10.el7_9.17 +10
  • RHSA-2025:19850 Released 2025-11-06 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libipa_hbac-2.6.2-4.el9_0.4, libsss_autofs-2.6.2-4.el9_0.4, libsss_certmap-2.6.2-4.el9_0.4 +25
  • RHSA-2025:19610 Released 2025-11-04 · Red Hat rating Important
    sssd security update
    • Red Hat Enterprise Linux AppStream (v. 8) sssd-idp-2.9.4-5.el8_10.3
    • Red Hat Enterprise Linux BaseOS (v. 8) libipa_hbac-2.9.4-5.el8_10.3, libsss_autofs-2.9.4-5.el8_10.3, libsss_certmap-2.9.4-5.el8_10.3 +25
    • Red Hat Enterprise Linux CRB (v. 8) libsss_nss_idmap-devel-2.9.4-5.el8_10.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7Fixed RHSA-2025:22529
Red Hat Ceph Storage 8Fixed RHSA-2025:22548
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:19852
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2025:21067
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:19851, RHSA-2025:21020
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:19610
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:20954
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:19853
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:19854
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:19852
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:21067
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:19853
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:19851, RHSA-2025:21020
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:19610
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:20954
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:19859
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:19848
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:19849
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:19849
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:19853
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:19850
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:19854
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:19852
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2025:21067
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2025:19848
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:19849
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:19853
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:19610
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:19851, RHSA-2025:21020
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:20954
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:19847
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:19847
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:0316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:0677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:21329
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:23113
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:22724
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:22265
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:21795
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:22277
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2025:22256
Not affected: 2 products
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-11561
  2. 2026-10-03 Alias added: GHSA-gj84-8vfx-q3vm
  3. 2026-11-04 Fix available: openshift/[email protected], openshift/[email protected], openshift/[email protected] +6 · CNA
  4. 2026-11-05 Affected versions changed · Red Hat

References

Advisory 24

Other 4

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences