CVE-2026-40212 is a DOM-based Cross-Site Scripting vulnerability in OpenStack Skyline's console interface. The vulnerability occurs due to unsafe use of document.write when rendering instance console logs, which can lead to improper neutralization of input during web page generation (CWE-79). It affects versions prior to 5.0.1, 6.0.0, and 7.0.0. The CVSS 3.1 base score is 5.4, indicating medium severity. The vulnerability requires at least low privileges and user interaction to exploit and impacts confidentiality and integrity with no impact on availability. No patch or official remediation level has been disclosed yet.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the administrator's browser when viewing instance console logs. This could lead to partial confidentiality and integrity compromise of the affected system's data accessible via the console interface. There is no known impact on system availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when viewing instance console logs and consider limiting access to the console web interface to trusted users only. Avoid interacting with untrusted or suspicious console log content. Monitor OpenStack vendor advisories for updates on patches or mitigations.