CVE-2026-40683High· 7.7▾ TwilightA flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as di…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the user_enabled_invert configuration option is set to False. This error causes users marked as disabled in LDAP to be treated as enabled within Keystone, allowing them to authenticate and perform actions despite their disabled status. This can lead to unauthorized access to resources.
OpenStack Keystone: OpenStack Keystone: Unauthorized access due to incorrect LDAP user status handling — rated Moderate by Red Hat. Released 2026-04-14, updated 2026-09-16.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:39808
Workarounds / mitigations:
user_enabled_invert option to True in the keystone.conf file.Example:
[ldap]
user_enabled_invert = True
After modifying the configuration, restart the Keystone service for the changes to take effect. This may temporarily disrupt authentication services.
Additionally the user should start using an LDAP attribute with inverted semantics (such as nsAccountLock) …
Affected packages:
keystone < 28.0.1Patched in:
keystone 28.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-96644High· 7.1pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser (CVE-2026-96644)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)