Executive brief
OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles disabled user accounts when using LDAP for authentication. Due to a coding error, Keystone may incorrectly treat accounts marked as 'disabled' in the corporate directory as 'enabled' because it fails to properly interpret the status data. This could allow unauthorized or former employees to continue accessing cloud resources and performing actions even after their accounts have been deactivated in the central directory.
Technical details
A vulnerability exists in the OpenStack Keystone LDAP identity backend where the '_ldap_res_to_model' method in the 'UserApi' class fails to convert the 'enabled' attribute from a string to a boolean when 'user_enabled_invert' is set to False (the default). In Python, non-empty strings like "FALSE" evaluate to True in a boolean context. Consequently, Keystone interprets any non-empty status string from LDAP as an enabled state. Attackers with disabled LDAP credentials can bypass intended access controls to authenticate and perform actions. The issue is resolved in version 28.0.1 and backported to stable branches.
Affected products
- OpenStack Keystone 8.0.0 to 25.0.0, 26.0.0 to 26.1.0, 27.0.0, 28.0.0
Timeline
- 2025-08-21: disclosed: Initial bug report on Launchpad
- 2026-03-16: patched: Fix included in 29.0.0.0rc1 release candidate
- 2026-04-14: advisory: NVD publication date