What is the CVSS score of CVE-2026-40683?

CVE-2026-40683 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-40683?

OpenStack Keystone versions 8.0.0 through 28.0.0 contain a critical authentication bypass in LDAP identity backends that allows disabled user accounts to authenticate successfully, potentially…. A patch is available.

How to fix or mitigate CVE-2026-40683?

Within 24 hours: inventory all OpenStack Keystone deployments and identify those using LDAP backends (check identity backend configuration); disable or suspend high-risk LDAP-integrated Keystone instances if business operations allow. Within 7 days: implement compensating controls by setting user_enabled_invert=True in Keystone LDAP backend configuration to invert the disabled status interpretation, or enforce LDAP group membership requirements to restrict authentication. Within 30 days: monitor OpenStack vendor advisories for patched versions beyond 28.0.0; establish automated testing of LDAP disabled account rejection before upgrading; apply vendor patch immediately upon release.

Python CVE-2026-40683

EUVD-2026-22701 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-14 cve@mitre.org

GHSA-pfx2-9x9m-7ghx

Information Disclosure Memory Corruption Python Red Hat

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Red Hat

7.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Patch released

Apr 16, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 22:38 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 20:22 euvd

EUVD-2026-22701

Analysis Generated

Apr 14, 2026 - 20:22 vuln.today

CVE Published

Apr 14, 2026 - 20:16 nvd

HIGH 7.7

DescriptionCVE.org

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g. "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.

AnalysisAI

OpenStack Keystone's LDAP identity backend grants authentication access to disabled user accounts due to improper string-to-boolean conversion logic. Versions 8.0.0 through 28.0.0 fail to convert LDAP-disabled status into boolean values when user_enabled_invert is False (default), causing disabled accounts to authenticate as enabled. This affects all LDAP-backed Keystone deployments without specific configuration overrides. CVSS 7.7 with changed scope (S:C) indicates potential cross-tenant privilege issues. EPSS data not available; no public exploit identified at time of analysis, though the logic flaw is straightforward to trigger with valid low-privilege credentials.

Technical ContextAI

OpenStack Keystone is the identity service component providing authentication and authorization for OpenStack cloud environments. The LDAP identity backend integrates with enterprise directory services for user management. The vulnerability exists in the UserApi class's _ldap_res_to_model method, which handles attribute mapping between LDAP responses and Keystone's internal user model. CWE-843 (Access of Resource Using Incompatible Type) describes the root cause: when user_enabled_invert configuration is False, the method fails to convert LDAP's user-enabled attribute (typically a string like 'TRUE' or 'FALSE') into Python boolean type. Python evaluates any non-empty string as truthy, so the string 'FALSE' from LDAP becomes True in Keystone's logic. The affected code path skips boolean conversion entirely, relying on raw LDAP string values. Affected products include Keystone versions 8.0.0-25.0.0, 26.0.0-26.1.0, 27.0.0, and 28.0.0 across multiple OpenStack releases (Victoria through 2024.2 Dalmatian).

RemediationAI

Upgrade to patched versions immediately: Keystone 25.0.1, 26.1.1, 27.0.1, or 28.0.1 depending on deployment branch. The upstream fix is available in OpenDev review https://review.opendev.org/958205 with backports to stable branches. For deployments unable to upgrade immediately, configure user_enabled_invert=True in keystone.conf under the [ldap] section as a temporary workaround, though this inverts the logic and requires LDAP schema compatibility testing. Alternatively, enable user_enabled_emulation configuration option. After patching, audit authentication logs for disabled LDAP accounts that successfully authenticated during the vulnerability window and review their activity for unauthorized access. Verify LDAP-sourced user account statuses are correctly synchronized post-upgrade. Consult security announcements at https://www.openwall.com/lists/oss-security/2026/04/14/9 for additional deployment-specific guidance.