EUVD-2026-22701
GHSA-pfx2-9x9m-7ghx
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Lifecycle Timeline
2DescriptionNVD
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g. "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.
AnalysisAI
OpenStack Keystone's LDAP identity backend grants authentication access to disabled user accounts due to improper string-to-boolean conversion logic. Versions 8.0.0 through 28.0.0 fail to convert LDAP-disabled status into boolean values when user_enabled_invert is False (default), causing disabled accounts to authenticate as enabled. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all OpenStack Keystone deployments and identify those using LDAP backends (check identity backend configuration); disable or suspend high-risk LDAP-integrated Keystone instances if business operations allow. Within 7 days: implement compensating controls by setting user_enabled_invert=True in Keystone LDAP backend configuration to invert the disabled status interpretation, or enforce LDAP group membership requirements to restrict authentication. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today