{"id":"CVE-2026-40683","title":"OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect LDAP user status handling (CVE-2026-40683)","summary":"A flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as di…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","cvssSource":"vendor","cwe":"CWE-843","vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","affected":["openstack_platform_13_queens","openstack_services_on_openshift 18.0"],"patched":["openstack_services_on_openshift 18.0"],"published":"2026-04-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T21:02:02+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40683"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458472"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40683"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40683"},{"url":"https://bugs.launchpad.net/keystone/+bug/2121152"},{"url":"https://bugs.launchpad.net/keystone/+bug/2141713"},{"url":"https://review.opendev.org/958205"},{"url":"https://www.openwall.com/lists/oss-security/2026/04/14/9"},{"url":"https://access.redhat.com/errata/RHSA-2026:39808"},{"url":"https://github.com/openstack/keystone"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00337,"epssPercentile":0.27147,"aliases":["GHSA-pfx2-9x9m-7ghx","PYSEC-2026-2550"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:01.432Z","slug":"CVE-2026-40683","body":"## Overview\n\nA flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as disabled in LDAP to be treated as enabled within Keystone, allowing them to authenticate and perform actions despite their disabled status. This can lead to unauthorized access to resources.\n\n## Vendor advisories\n\n- **RHSA-2026:39808** · Red Hat · fixed in: Red Hat OpenStack Services on OpenShift 18.0 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39808)\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat OpenStack Platform 13 (Queens) · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json)\n\n**OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect LDAP user status handling** — rated Moderate by Red Hat. Released 2026-04-14, updated 2026-09-16.\n\nAffected:\n\n- Red Hat OpenStack Platform 13 (Queens)\n\nFixed:\n\n- Red Hat OpenStack Services on OpenShift 18.0\n\nNo fix planned:\n\n- Red Hat OpenStack Platform 13 (Queens)\n\nNot affected:\n\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:39808\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, configure OpenStack Keystone to correctly interpret the LDAP user enabled attribute. Set the `user_enabled_invert` option to `True` in the `keystone.conf` file.\n\nExample:\n```ini\n[ldap]\nuser_enabled_invert = True\n```\n\nAfter modifying the configuration, restart the Keystone service for the changes to take effect. This may temporarily disrupt authentication services.\n\nAdditionally the user should start using an LDAP attribute with inverted semantics (such as nsAccountLock) …\n\n## Package advisory (CVE-2026-40683)\n\nAffected packages:\n\n- `keystone < 28.0.1`\n\nPatched in:\n\n- `keystone 28.0.1`\n\nSource: https://osv.dev/vulnerability/GHSA-pfx2-9x9m-7ghx","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}