# CVE-2026-5208: CoolerControl coolercontrold command injection in alerts

Source: https://junglewise.ai/threats/cve-2026-5208-coolercontrol-coolercontrold-command-injection-in-alerts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5208 · Severity: high · CVSS 8.2 · Published 2026-04-08

CoolerControl is a system utility used to monitor and manage hardware cooling, such as fan speeds and liquid coolers. A security flaw allows an authorized user to take complete control of the underlying operating system by including malicious commands in the names of system alerts. This could lead to a total compromise of the machine, allowing an attacker to access sensitive data or disrupt operations with administrative privileges.

Technologies: [Coolercontrold](https://junglewise.ai/threats/technologies/coolercontrold). Vendors: [Coolercontrol](https://junglewise.ai/threats/vendors/coolercontrol).

## Quick answers

**Is CVE-2026-5208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5208 being exploited in the wild.

**How severe is CVE-2026-5208?** High severity, with a CVSS score of 8.2, published 8 April 2026.

**Which products and versions are affected?** CoolerControl >= 3.1.0, < 4.0.0.

**Is there a fix for CVE-2026-5208?** A patch was published on 2026-04-08: Fixed in version 4.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5208 attacked?** It is attacked with local access or over the network, in an operating system.

**Am I affected by CVE-2026-5208?** Check whether you run CoolerControl or Coolercontrold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in CoolerControl's daemon, coolercontrold, specifically within the alert handling logic in alerts.rs. The vulnerability is triggered when the application fails to properly sanitize alert names before passing them to a shell for execution. An authenticated attacker with high privileges can inject Bash commands into an alert name to achieve arbitrary code execution with root privileges. This issue affects versions starting from 3.1.0 and is fixed in version 4.0.0. While some assessments suggest a network vector, the primary risk involves local privilege escalation or exploitation via the management interface.

## Affected products

- CoolerControl coolercontrold >= 3.1.0, < 4.0.0

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 4.0.0

## References

- [https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags](https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags)
- [https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0](https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0)

## Related threats

- [CoolerControl coolercontrold CORS misconfiguration](https://junglewise.ai/threats/cve-2026-5302-coolercontrol-coolercontrold-cors-misconfiguration)
- [CoolerControl coolercontrol-ui stored XSS in log viewer](https://junglewise.ai/threats/cve-2026-5301-coolercontrol-coolercontrol-ui-stored-xss-in-log-viewer)
- [CoolerControl coolercontrold missing authentication in API router](https://junglewise.ai/threats/cve-2026-5300-coolercontrol-coolercontrold-missing-authentication-in-api-router)