LDAP User Authentication Flaw in OpenStack Keystone

CVE-2026-40683

What is CVE-2026-40683?

In OpenStack Keystone prior to version 28.0.1, a significant flaw exists within the LDAP identity backend. Due to a misconfiguration involving the user_enabled_invert option, the software fails to accurately interpret the user enabled attribute. Specifically, the _ldap_res_to_model method in the UserApi class only processes string-to-boolean conversion when user_enabled_invert is set to True. When False, raw string values from LDAP, such as 'FALSE', were improperly treated as enabled, allowing users marked as disabled to authenticate and access functionalities within the system. This misconfiguration poses a serious security risk for deployments that rely on the LDAP identity backend without enabling the proper settings.

References