CVE-2026-5208
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.
Risk Assessment
An attacker can gain full control over the system, leading to compromise of confidentiality, integrity, and availability.
Recommendation
Upgrade CoolerControl/coolercontrold to version 4.0.0 or later.
Other vulnerabilities in CoolerControl
See all- CVE-2026-5302Medium
CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.
- CVE-2026-5301High
In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.
- CVE-2026-5300Medium
In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.
Original NVD description (English source)
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names