CVE-2026-5208 - Vulnerability Analysis

Overview

CoolerControl coolercontrold <4.0.0 contains a command injection caused by injected bash commands in alert names, letting authenticated attackers execute arbitrary code as root, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can execute arbitrary code as root, leading to full system compromise.

Mitigation

Update to version 4.0.0 or later.

References

• https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags#L576
• https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner