CVE Intelligence
Analysis AI-assisted

CVE-2026-5300: CoolerControl coolercontrold Missing Authentication for Critical Function

CVE-2026-5300 affects CoolerControl coolercontrold before 4.0.0, where some functionality can be reached without authentication. According to the record, unauthenticated attackers can view and modify potentially sensitive data through HTTP requests. NVD rates it 9.1 (critical), while GitLab and GitHub rate it 5.9 (medium).

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5300 is classified as CWE-306, missing authentication for a critical function, in CoolerControl coolercontrold. The record states that some functionality can be reached without authentication, which lets unauthenticated attackers view and modify potentially sensitive data over HTTP. The entry was published on 2026-04-08.

Impact

  • Confidentiality: the NVD assessment marks the impact as high.
  • Integrity: the NVD assessment marks the impact as high.
  • Availability: the NVD assessment marks no availability impact.
  • The record calls the data potentially sensitive but does not describe which data types are exposed.

Affected products and versions

  • Product: Coolercontrol Coolercontrold.
  • The record lists versions before 4.0.0 and the range from 0.14.0 up to but not including 4.0.0.
  • The record does not state whether versions before 0.14.0 are affected.

Exploitation status

  • The record shows no CISA KEV listing for this CVE.
  • The SSVC data in the record rates exploitation as none and automatable as no.
  • The EPSS probability is 0.0028 with a percentile of 0.19375 at the recorded date.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade to version 4.0.0 or later, since the affected range ends before 4.0.0. The release notes are available in the GitLab release 4.0.0 page.
  • Until the upgrade is complete, restrict network access to the coolercontrold HTTP interface so that only trusted administrative hosts can reach it.
  • Review whether sensitive settings or data were accessed or changed before patching.

Detection guidance

  • Review HTTP access logs for requests to the coolercontrold service from unexpected sources or without a valid authenticated session.
  • Monitor for unexpected changes to settings managed by the software.

Limitations of the available information

  • Severity sources disagree: NVD gives 9.1 (critical), while GitLab and GitHub give 5.9 (medium).
  • The record does not describe the specific endpoints, data types or authentication mechanism involved.
  • The fixes list in the record is empty. The 4.0.0 boundary is inferred from the affected range and the release page.
  • Exploitation prerequisites beyond network reachability are not detailed.

See also the NVD entry and the GitHub advisory.

Frequently asked questions

What is CVE-2026-5300?

It is a missing authentication issue (CWE-306) in CoolerControl coolercontrold before 4.0.0, which lets unauthenticated attackers view and modify potentially sensitive data over HTTP.

Which versions are affected?

The record lists versions before 4.0.0 and the range from 0.14.0 up to but not including 4.0.0.

Is this vulnerability known to be exploited?

The record shows no CISA KEV listing and no confirmed exploitation appears in the sources consulted. SSVC rates exploitation as none.

What should administrators do?

Upgrade to 4.0.0 or later and, until then, restrict network access to the HTTP interface to trusted hosts.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.