CVE-2026-40683

Отчет

There's a flaw in OpenStack Keystone's LDAP identity backend allows unauthorized access. When the user_enabled_invert configuration option is set to its default of False, users marked as disabled in LDAP are incorrectly treated as enabled within Keystone. This enables them to authenticate and perform actions, affecting Red Hat OpenStack Platform deployments utilizing the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation configured. This flaw happens due to the fact that any non-empty string in the Python programing language are handled as True, openstack-keystone lacks the proper conversion from string to boolean type when reading the user enabled LDAP attribute when the user_enabled_invert configuration is set to false, this will lead to any previously existing user which is disabled in the LDAP side will be handled as enabled by the OpenStack Keystone. Red Hat Product Security has rated this flaw as having the severity of Moderate as for exploiting this flaw the attacker needs to have a previous access to the targeted system, additionally the impact will be limited to the same level of access the attacker had previously it had its user disabled in the LDAP side.

Меры по смягчению последствий

To mitigate this issue, configure OpenStack Keystone to correctly interpret the LDAP user enabled attribute. Set the user_enabled_invert option to True in the keystone.conf file. Example:

After modifying the configuration, restart the Keystone service for the changes to take effect. This may temporarily disrupt authentication services. Additionally the user should start using an LDAP attribute with inverted semantics (such as nsAccountLock) to match the same semantics of the keystone side.