---
id: CVE-2026-40683
title: >-
  OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect
  LDAP user status handling (CVE-2026-40683)
summary: >-
  A flaw was found in OpenStack Keystone. When using the LDAP identity backend,
  the system incorrectly processes the user enabled attribute if the
  user_enabled_invert configuration option is set to False. This error causes
  users marked as di…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H'
cvssSource: vendor
cwe: CWE-843
vendor: Red Hat
product: Red Hat OpenStack Platform 13 (Queens)
affected:
  - openstack_platform_13_queens
  - openstack_services_on_openshift 18.0
patched:
  - openstack_services_on_openshift 18.0
published: '2026-04-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T21:02:02+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-40683'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2458472'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-40683'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40683'
  - url: 'https://bugs.launchpad.net/keystone/+bug/2121152'
  - url: 'https://bugs.launchpad.net/keystone/+bug/2141713'
  - url: 'https://review.opendev.org/958205'
  - url: 'https://www.openwall.com/lists/oss-security/2026/04/14/9'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39808'
  - url: 'https://github.com/openstack/keystone'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00337
epssPercentile: 0.27245
aliases:
  - GHSA-pfx2-9x9m-7ghx
  - PYSEC-2026-2550
ecosystem: pip
ingestedAt: '2026-07-13T18:58:01.432Z'
---

## Overview

A flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as disabled in LDAP to be treated as enabled within Keystone, allowing them to authenticate and perform actions despite their disabled status. This can lead to unauthorized access to resources.

## Vendor advisories

- **RHSA-2026:39808** · Red Hat · fixed in: Red Hat OpenStack Services on OpenShift 18.0 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39808)
- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat OpenStack Platform 13 (Queens) · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40683.json)

**OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect LDAP user status handling** — rated Moderate by Red Hat. Released 2026-04-14, updated 2026-09-16.

Affected:

- Red Hat OpenStack Platform 13 (Queens)

Fixed:

- Red Hat OpenStack Services on OpenShift 18.0

No fix planned:

- Red Hat OpenStack Platform 13 (Queens)

Not affected:

- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0

## Remediation

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:39808

Workarounds / mitigations:

- To mitigate this issue, configure OpenStack Keystone to correctly interpret the LDAP user enabled attribute. Set the `user_enabled_invert` option to `True` in the `keystone.conf` file.

Example:
```ini
[ldap]
user_enabled_invert = True
```

After modifying the configuration, restart the Keystone service for the changes to take effect. This may temporarily disrupt authentication services.

Additionally the user should start using an LDAP attribute with inverted semantics (such as nsAccountLock) …

## Package advisory (CVE-2026-40683)

Affected packages:

- `keystone < 28.0.1`

Patched in:

- `keystone 28.0.1`

Source: https://osv.dev/vulnerability/GHSA-pfx2-9x9m-7ghx