CVE-2026-5300
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.
Risk Assessment
Unauthenticated attackers can access or modify sensitive data, posing a serious threat to system confidentiality and integrity.
Recommendation
Immediately update CoolerControl to version 4.0.0 or later, which fixes this vulnerability.
Other vulnerabilities in CoolerControl
See all- CVE-2026-5302Medium
CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.
- CVE-2026-5301High
In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.
- CVE-2026-5208High
In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.
Original NVD description (English source)
Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS