CVE-2026-40683: [OSSA-2026-007] OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (CVE-2026-40683)
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the userenabledinvert configuration option is False (the default). The ldaprestomodel method in the UserApi class only performed string-to-boolean conversion when userenabledinvert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without userenabledinvert=True or userenabledemulation are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/keystoneto a version that resolves this vulnerability.Fixed in 2:18.1.0-1+deb11u3Fixed in 2:22.0.2-0+deb12u3Fixed in 2:27.0.0-3+deb13u4Fixed in 2:29.0.1-2 - Upgrade
Upgrade
OpenStack Keystoneto a version that resolves this vulnerability.Fixed in 28.0.1Patch OSSA-2026-007 - Configuration
For the LDAP identity backend, set user_enabled_invert=True so Keystone performs string-to-boolean conversion for the LDAP user enabled attribute (mitigates CVE-2026-40683 / OSSA-2026-007 where non-empty LDAP strings like "FALSE" are treated as truthy when the conversion is not performed).
OpenStack Keystone (UserApi LDAP identity backend) user_enabled_invert = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40683?
CVE-2026-40683 has not been assigned a specific severity rating, but it can lead to unauthorized access due to misconfiguration.
How do I fix CVE-2026-40683?
To fix CVE-2026-40683, update OpenStack Keystone to version 28.0.1 or later, where this issue is addressed.
Who is affected by CVE-2026-40683?
CVE-2026-40683 affects users of OpenStack Keystone versions prior to 28.0.1 that utilize the LDAP identity backend.
What type of vulnerability is CVE-2026-40683?
CVE-2026-40683 is a configuration vulnerability related to the LDAP identity backend in OpenStack Keystone.
What is the impact of CVE-2026-40683?
The impact of CVE-2026-40683 may include incorrect handling of user enablement status, potentially allowing unauthorized user access.