Executive brief
OpenStack Skyline is a web-based dashboard used by administrators to manage cloud resources. A security flaw in the console log viewer allows a regular cloud user to inject malicious scripts into a virtual machine's log. If an administrator views these logs through the dashboard, the script can execute in their browser, potentially allowing the attacker to hijack the administrator's session or access sensitive management APIs.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the OpenStack Skyline Console frontend. The vulnerability is caused by the unsafe use of 'document.write()' in the instance console log viewer component (src/pages/compute/containers/Instance/Detail/Log/index.jsx), which renders log data without proper sanitization or escaping. An attacker with the ability to write to a virtual machine's console (e.g., via user-data or /dev/console) can inject malicious HTML/JavaScript. When an administrator views the 'Full Log' in the Skyline UI, the script executes within the Skyline Console origin. This allows the attacker to access authenticated session data and interact with administrative APIs. Patches are available in versions 5.0.1, 8.0.0 (Gazpacho), and specific backports for Dalmatian, Epoxy, and Flamingo releases.
Affected products
- OpenStack Skyline Console < 5.0.1, 6.0.0, 7.0.0
Timeline
- 2026-01-18: disclosed: Bug reported to OpenStack by Myunghyun Lee
- 2026-04-09: advisory: OpenStack Security Advisory OSSA-2026-006 published
- 2026-04-10: other: CVE-2026-40212 assigned by MITRE