CVE-2025-11561 — SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

In default SSSD configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is not enabled. An attacker with permission to modify certain Active Directory attributes, such as userPrincipalName or samAccountName, can impersonate privileged users and gain unauthorized access or escalate privileges on domain-joined Linux hosts.