CVE-2026-40212

OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs.

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-26)

CWE

CWE-79

Published

2026-04-10

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

References

• https://bugs.launchpad.net/skyline-console/+bug/2138575
• https://review.opendev.org/973351
• https://security.openstack.org/ossa/OSSA-2026-006.html
• https://www.openwall.com/lists/oss-security/2026/04/09/30

Check your stackJSON