CVE-2026-5302
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.
Risk Assessment
An attacker can remotely read data and control the service, potentially leading to unauthorized access and manipulation of the cooling system.
Recommendation
Update CoolerControl/coolercontrold to version 4.0.0 or later.
Other vulnerabilities in CoolerControl
See all- CVE-2026-5301High
In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.
- CVE-2026-5300Medium
In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.
- CVE-2026-5208High
In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.
Original NVD description (English source)
CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites
Vulnerability data from NVD (NIST) · CISA KEV · EPSS