CVE-2026-40683

OpenStack Keystone versions prior to 28.0.1 do not convert the LDAP user_enabled attribute to a boolean when the user_enabled_invert configuration option is False, the default. Because non‑empty strings such as "FALSE" evaluate as true in Python, users who are marked as disabled in the LDAP directory are incorrectly treated as enabled by Keystone. This misinterpretation allows an attacker to authenticate with a supposedly disabled user account, granting unauthorized access to Keystone services. The underlying weakness corresponds to CWE‑843, an inappropriate type conversion that leads to incorrect logic.

This vulnerability affects deployments of OpenStack Keystone that use the LDAP identity backend and have not set user_enabled_invert to True or enabled user_enabled_emulation. All versions of Keystone released before 28.0.1 are potentially impacted if the default configuration is in use.

The vulnerability scores a CVSS v3.1 base score of 7.7, indicating high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an adversary who can either exploit an existing LDAP service that feeds Keystone, or manipulate LDAP data to mark a user as disabled while the backend still authenticates them. Given the logic flaw, exploitation is straightforward once the necessary LDAP data is present, and no additional privileges are required beyond a valid LDAP account that is disabled by definition.