PT-2026-32909 · Openstack · Keystone

Andrew Bogott + 1 · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-40683

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 28.0.1

Description The LDAP identity backend fails to convert the user enabled attribute to a boolean value when the user enabled invert configuration option is set to False. Specifically, the ldap res to model() function in the UserApi class only performs string-to-boolean conversion when user enabled invert is True. When False, the raw string value from LDAP is used. Because non-empty strings are considered truthy in Python, users marked as disabled in LDAP are treated as enabled, allowing them to authenticate and perform actions. This affects deployments using the LDAP identity backend without user enabled invert=True or user enabled emulation.

Recommendations Update to version 28.0.1 or later. As a temporary workaround, set the user enabled invert configuration option to True or enable user enabled emulation.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2026-40683

GHSA-PFX2-9X9M-7GHX

Affected Products

Keystone

References · 14

• https://security-tracker.debian.org/tracker/CVE-2026-40683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40683 · Security Note
• https://ubuntu.com/security/CVE-2026-40683 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfx2-9x9m-7ghx · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40683 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40683 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40683 · Vendor Advisory
• https://github.com/openstack/keystone · Note
• https://bugs.launchpad.net/keystone/+bug/2141713 · Note
• https://review.opendev.org/958205 · Note
• https://twitter.com/CVEnew/status/2044338936294826257 · Twitter Post
• https://openwall.com/lists/oss-security/2026/04/14/9 · Note
• https://bugs.launchpad.net/keystone/+bug/2121152 · Note
• https://twitter.com/infoflowcloud/status/2044340179318542683 · Twitter Post