Skip to content
Fencer Intel
high 7.7

CVE-2026-40683 json

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

published 6mo ago modified last mo. also GHSA-pfx2-9x9m-7ghx , PYSEC-2026-2550 , EUVD-2026-22701

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.

Patch / fix

  • pypi keystone 28.0.1
  • OpenStack Keystone 25.0.1, 26.1.1, 27.0.1, 28.0.1
  • keystone Debian 12 2:22.0.2-0+deb12u2
  • keystone Debian 13 2:27.0.0-3+deb13u3
  • keystone Debian 14 2:29.0.0~rc1-2

debian advisories DEBIAN-CVE-2026-40683

  • keystone Ubuntu 22.04 LTS 2:21.0.1-0ubuntu2.4
  • keystone Ubuntu 24.04 LTS 2:25.0.0-0ubuntu1.4
  • keystone Ubuntu 25.10 2:28.0.0-0ubuntu1.3

ubuntu advisories UBUNTU-CVE-2026-40683

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3-keystone openstack 18.0 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost
  • openstack-keystone openstack 18.0 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost

red hat advisories RHSA-2026:39808

Is CVE-2026-40683 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40683 updated cvss 7.7

OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect LDAP user status handling

  • Red Hat OpenStack Platform 13 (Queens) python-keystone, openstack-keystone, rhosp13/openstack-keystone
    affected: workaround, no fix available
  • Red Hat OpenStack Services on OpenShift 18.0 python3-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost, openstack-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost
    fixed: vendor fix RHSA-2026:39808
  • Red Hat OpenStack Platform 16.2 python3-keystone, openstack-keystone, rhosp-rhel8/openstack-keystone Red Hat OpenStack Platform 17.1 python3-keystone, openstack-keystone, rhosp-rhel9/openstack-keystone
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 18.0 rhoso/openstack-keystone-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
OSV 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Affected packages

ecosystem package affected fixed in
pypi keystone
<28.0.1
28.0.1

Affected products

  • OpenStack Keystone

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.