CVE-2026-40683: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in OpenStack Keystone
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.
AI Analysis
Technical Summary
In OpenStack Keystone versions prior to 28.0.1, the LDAP identity backend mishandles the user enabled attribute due to improper type conversion. Specifically, when the user_enabled_invert configuration option is False, the _ldap_res_to_model method in the UserApi class does not convert the LDAP user enabled attribute string to a boolean. Since non-empty strings are truthy in Python, users disabled in LDAP (e.g., with the string "FALSE") are incorrectly treated as enabled by Keystone. This allows unauthorized authentication and potential misuse of privileges. The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type, or Type Confusion).
Potential Impact
This vulnerability allows users who are marked as disabled in the LDAP directory to authenticate successfully and perform actions in OpenStack Keystone. This can lead to unauthorized access and potential privilege misuse within the affected OpenStack deployments. The CVSS v3.1 score is 7.7 (high severity), reflecting network attack vector, high impact on availability, and low privileges required for exploitation without user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, deployments should consider setting the user_enabled_invert configuration option to True or enabling user_enabled_emulation as a temporary mitigation to ensure proper boolean conversion of the user enabled attribute. Monitor vendor communications for an official patch or update.
CVE-2026-40683: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in OpenStack Keystone
Description
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.
CVSS v3.1
Score 7.7high
Affected software
OpenStack
Keystone
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenStack Keystone versions prior to 28.0.1, the LDAP identity backend mishandles the user enabled attribute due to improper type conversion. Specifically, when the user_enabled_invert configuration option is False, the _ldap_res_to_model method in the UserApi class does not convert the LDAP user enabled attribute string to a boolean. Since non-empty strings are truthy in Python, users disabled in LDAP (e.g., with the string "FALSE") are incorrectly treated as enabled by Keystone. This allows unauthorized authentication and potential misuse of privileges. The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type, or Type Confusion).
Potential Impact
This vulnerability allows users who are marked as disabled in the LDAP directory to authenticate successfully and perform actions in OpenStack Keystone. This can lead to unauthorized access and potential privilege misuse within the affected OpenStack deployments. The CVSS v3.1 score is 7.7 (high severity), reflecting network attack vector, high impact on availability, and low privileges required for exploitation without user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, deployments should consider setting the user_enabled_invert configuration option to True or enabling user_enabled_emulation as a temporary mitigation to ensure proper boolean conversion of the user enabled attribute. Monitor vendor communications for an official patch or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-14T20:05:01.861Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69dea0b582d89c981ff4544a
Added to database: 04/14/2026, 20:16:53 UTC
Last enriched: 08/06/2026, 13:15:28 UTC
Last updated: 09/10/2026, 21:29:27 UTC
Views: 152
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.