CoolerControl vulnerabilities

Products

• coolercontrold 4
• coolercontrol-ui 1

Latest CoolerControl CVEs

Newest publication first

1. CVE-2026-5302 Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

   Published 2026-04-08

   High·CVSS 8.1 EPSS 0.27%

   CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

2. CVE-2026-5300 Missing Authentication for Critical Function in coolercontrold

   Published 2026-04-08

   Critical·CVSS 9.1 EPSS 0.22%

   Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests

3. CVE-2026-5301 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui

   Published 2026-04-08

   Medium·CVSS 6.1 EPSS 0.28%

   Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries

4. CVE-2026-5208 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

   Published 2026-04-08

   High·CVSS 7.2 EPSS 0.99%

   Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.