Threat Intelligence Database

CVE-2026-5302 is a medium severity vulnerability in CoolerControl's coolercontrold version 2.0.0 and earlier, caused by a permissive Cross-Origin Resource Sharing (CORS) policy that allows unauthenticated remote attackers to read data and send commands via malicious websites. This misconfiguration falls under CWE-942, indicating overly permissive cross-domain policies involving untrusted domains. There is no official patch or remediation level currently provided by the vendor, and no known exploits in the wild have been reported. The vulnerability enables attackers to bypass same-origin policy restrictions, potentially leading to unauthorized information disclosure and command execution on the affected service.

CVE-2026-5300 is a medium severity vulnerability in CoolerControl's coolercontrold version 0.14.0 and earlier. It involves missing authentication for critical functions, allowing unauthenticated attackers to view and modify potentially sensitive data via HTTP requests. The vulnerability is classified under CWE-306. There is no official patch or remediation level provided by the vendor at this time, and no known exploits in the wild have been reported.

CVE-2026-5208 is a high-severity OS command injection vulnerability in CoolerControl's coolercontrold versions prior to 4.0.0. Authenticated users with high privileges can inject arbitrary bash commands via alert names, leading to root-level code execution. This vulnerability affects version 3.1.0 and potentially other versions below 4.0.0. There is no official patch or remediation level currently provided by the vendor.