diff --git a/etc/nova/api-paste.ini b/etc/nova/api-paste.ini
index 13c8499170f7..cbac3e9ea5bd 100644
--- a/etc/nova/api-paste.ini
+++ b/etc/nova/api-paste.ini
@@ -61,7 +61,7 @@ paste.filter_factory = nova.api.openstack:LegacyV2CompatibleWrapper.factory
 paste.app_factory = nova.api.openstack.compute:APIRouterV21.factory
 
 [pipeline:oscomputeversions]
-pipeline = faultwrap http_proxy_to_wsgi oscomputeversionapp
+pipeline = cors faultwrap http_proxy_to_wsgi oscomputeversionapp
 
 [app:oscomputeversionapp]
 paste.app_factory = nova.api.openstack.compute.versions:Versions.factory
diff --git a/nova/tests/functional/test_middleware.py b/nova/tests/functional/test_middleware.py
index 00630b0e81da..40b2d519785b 100644
--- a/nova/tests/functional/test_middleware.py
+++ b/nova/tests/functional/test_middleware.py
@@ -96,3 +96,27 @@ class TestCORSMiddleware(api_sample_base.ApiSampleTestBaseV21):
 
         self.assertEqual(response.status_code, 200)
         self.assertNotIn('Access-Control-Allow-Origin', response.headers)
+
+    def test_valid_cors_get_versions_request(self):
+        response = self._do_get('',
+                                strip_version=True,
+                                headers={
+                                    'Origin': 'http://valid.example.com',
+                                    'Access-Control-Request-Method': 'GET'
+                                })
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIn('Access-Control-Allow-Origin', response.headers)
+        self.assertEqual('http://valid.example.com',
+                         response.headers['Access-Control-Allow-Origin'])
+
+    def test_invalid_cors_get_versions_request(self):
+        response = self._do_get('',
+                                strip_version=True,
+                                headers={
+                                    'Origin': 'http://invalid.example.com',
+                                    'Access-Control-Request-Method': 'GET'
+                                })
+
+        self.assertEqual(response.status_code, 200)
+        self.assertNotIn('Access-Control-Allow-Origin', response.headers)
diff --git a/releasenotes/notes/add-cors-to-versions-pipeline-56277ca66e796569.yaml b/releasenotes/notes/add-cors-to-versions-pipeline-56277ca66e796569.yaml
new file mode 100644
index 000000000000..928c4a0ffcc1
--- /dev/null
+++ b/releasenotes/notes/add-cors-to-versions-pipeline-56277ca66e796569.yaml
@@ -0,0 +1,6 @@
+---
+upgrade:
+  - CORS headers have been added to the versions REST API, in order
+    to support versions discovery. If using 'oscomputeversions'
+    pipeline in '/etc/nova/api-paste.ini', it is required to update the
+    pipeline to include 'cors' filter.