CVE-2026-40212

{
  "id": "CVE-2026-40212",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-10T08:16:25.850",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs."
    },
    {
      "lang": "es",
      "value": "OpenStack Skyline anterior a las versiones 5.0.1, 6.0.0 y 7.0.0 tiene una vulnerabilidad de cross-site scripting (XSS) basada en DOM en la consola debido a que document.write se utiliza de forma insegura, lo cual es relevante en escenarios donde los administradores utilizan la interfaz web de la consola para ver los registros de la consola de la instancia."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenStack",
          "product": "Skyline",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.0.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T13:49:14.717690Z",
          "id": "CVE-2026-40212",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.launchpad.net/skyline-console/+bug/2138575",
      "source": "[email protected]"
    },
    {
      "url": "https://review.opendev.org/973351",
      "source": "[email protected]"
    },
    {
      "url": "https://security.openstack.org/ossa/OSSA-2026-006.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2026/04/09/30",
      "source": "[email protected]"
    }
  ]
}