Sign in
Deutsch English Español Polski
High

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

  • Disclosed: 14.04.2026
  • Updated: 11.10.2026 15:17

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) keystone < 28.0.1 28.0.1

References

CVSS score 7.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Weakness (CWE)
CWE-843
Platform
Python (PyPI)
Package
keystone
Disclosed
14.04.2026
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2550 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-pfx2-9x9m-7ghx - CC BY 4.0

Vulnerability history: keystone

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (42) in the archive
Total entries
42
First → latest
09.2012 05.2026
Without a fix
3
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 18
  • Medium 21
  • Low 1
  • Unrated 1

Disclosures per year

earlier: 13

Severity:
  1. OpenStack Keystone has an Incorrect Authorization Issue
    High · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 no fix
  2. OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean this entry
    High · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
  3. OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
    High · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
  4. Openstack Keystone Incorrect Authorization vulnerability
    Critical · 9.1 CVE-2021-3563 <= 21.0.0 no fix
  5. OpenStack Keystone allows information disclosure during account locking
    High · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
  6. OpenStack Keystone Improper Authentication vulnerability
    High CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
  7. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat
    High · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
  8. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p
    High · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
  9. Insufficient Session Expiration in OpenStack Keystone
    High · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
  10. OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc
    High · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
  11. An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten
    High · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
  12. OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
    High · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
  13. OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
    High · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
  14. OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events
    High · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
  15. OpenStack Keystone Domain-scoped tokens don't get revoked
    High · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
  16. OpenStack Identity (Keystone) DoS through V3 API authentication chaining
    High · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
  17. OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
    High · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
  18. OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating
    High · 5.9 CVE-2012-5563 all versions no fix
  19. OpenStack Keystone Allows Remote User Account Creation
    High · 7.5 CVE-2012-3542 < 2012.1 2012.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.