CVE-2026-40683
Description
A flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as disabled in LDAP to be treated as enabled within Keystone, allowing them to authenticate and perform actions despite their disabled status. This can lead to unauthorized access to resources.
Statement
There's a flaw in OpenStack Keystone's LDAP identity backend allows unauthorized access. When the user_enabled_invert configuration option is set to its default of False, users marked as disabled in LDAP are incorrectly treated as enabled within Keystone. This enables them to authenticate and perform actions, affecting Red Hat OpenStack Platform deployments utilizing the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation configured.
This flaw happens due to the fact that any non-empty string in the Python programing language are handled as True, openstack-keystone lacks the proper conversion from string to boolean type when reading the user enabled LDAP attribute when the user_enabled_invert configuration is set to false, this will lead to any previously existing user which is disabled in the LDAP side will be handled as enabled by the OpenStack Keystone.
Red Hat Product Security has rated this flaw as having the severity of Moderate as for exploiting this flaw the attacker needs to have a previous access to the targeted system, additionally the impact will be limited to the same level of access the attacker had previously it had its user disabled in the LDAP side.
Mitigation
To mitigate this issue, configure OpenStack Keystone to correctly interpret the LDAP user enabled attribute. Set the `user_enabled_invert` option to `True` in the `keystone.conf` file.
Example:
ini
[ldap]
user_enabled_invert = True
After modifying the configuration, restart the Keystone service for the changes to take effect. This may temporarily disrupt authentication services.
Additionally the user should start using an LDAP attribute with inverted semantics (such as nsAccountLock) to match the same semantics of the keystone side.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Understanding the Weakness (CWE)
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
