Detections
Analytics

SCA: security update for keystone (GHSA-pfx2-9x9m-7ghx)

high Tenable Cloud Security Plugin ID 440475

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute
 to a boolean when the user_enabled_invert configuration option is False (the default). The
 _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when
 user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used
 directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as
 enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP
 identity backend without user_enabled_invert=True or user_enabled_emulation are affected. (CVE-2026-40683)

Solution

Update the keystone library and its related packages to version 28.0.1 or later.

See Also

https://github.com/advisories/GHSA-pfx2-9x9m-7ghx

Plugin Details

Severity: High

ID: 440475

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 4/16/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

Percentile: 57.56

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:C

CVSS Score Source: CVE-2026-40683

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-40683

cwe: CWE-843