CVE-2026-40212

Description

OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs.

PUBLISHED Reserved 2026-04-10 | Published 2026-04-10 | Updated 2026-04-10 | Assigner mitre

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

References

bugs.launchpad.net/skyline-console/+bug/2138575

review.opendev.org/973351

www.openwall.com/lists/oss-security/2026/04/09/30

security.openstack.org/ossa/OSSA-2026-006.html

cve.org (CVE-2026-40212)

nvd.nist.gov (CVE-2026-40212)

Download JSON