Alta

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

Publicada: 14.04.2026
Actualizado: 11.10.2026 15:17

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	keystone	< 28.0.1	28.0.1

Referencias

Puntuación CVSS 7.7/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Debilidad (CWE): CWE-843
Plataforma: Python (PyPI)
Paquete: keystone
Publicada: 14.04.2026
Actualizado: 11.10.2026 15:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-2550 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-pfx2-9x9m-7ghx - CC BY 4.0

Historial de vulnerabilidades: keystone

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (42) en el archivo

Entradas en total: 42
Primera → última: 09.2012 05.2026
Sin corrección: 3
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 18
Media 21
Baja 1
Sin evaluar 1

Divulgaciones por año

2017: 0
2018: 2
2019: 1
2020: 4
2021: 0
2022: 14
2023: 0
2024: 0
2025: 1
2026: 7

antes: 13

01.05.2026

OpenStack Keystone has an Incorrect Authorization Issue

Alta · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 sin corrección
14.04.2026

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean esta entrada

Alta · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
17.11.2025

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Alta · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
27.08.2022

Openstack Keystone Incorrect Authorization vulnerability

Crítica · 9.1 CVE-2021-3563 <= 21.0.0 sin corrección
24.05.2022

OpenStack Keystone allows information disclosure during account locking

Alta · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
14.05.2022

OpenStack Keystone Improper Authentication vulnerability

Alta CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
07.05.2020

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat

Alta · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
07.05.2020

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p

Alta · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
07.05.2020

Insufficient Session Expiration in OpenStack Keystone

Alta · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
09.12.2019

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc

Alta · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
19.07.2018

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten

Alta · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
03.02.2016

OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

Alta · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
25.08.2014

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

Alta · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
25.08.2014

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

Alta · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
25.08.2014

OpenStack Keystone Domain-scoped tokens don't get revoked

Alta · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
15.04.2014

OpenStack Identity (Keystone) DoS through V3 API authentication chaining

Alta · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
01.04.2014

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

Alta · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
18.12.2012

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating

Alta · 5.9 CVE-2012-5563 todas las versiones sin corrección
05.09.2012

OpenStack Keystone Allows Remote User Account Creation

Alta · 7.5 CVE-2012-3542 < 2012.1 2012.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación