Executive brief
CoolerControl is a system daemon used to monitor and control cooling hardware like fans and liquid coolers. A security flaw in versions prior to 4.0.0 allows unauthorized individuals to access the software's management interface without a password. This could allow an attacker to view sensitive system information or maliciously change cooling settings, potentially leading to hardware overheating or system instability.
Technical details
A missing authentication vulnerability (CWE-306) exists in the coolercontrold daemon of CoolerControl versions prior to 4.0.0. The issue resides in the API router component, which fails to enforce authentication for critical functions accessible via HTTP requests. A remote, unauthenticated attacker can exploit this to interact with the daemon's API, allowing them to read sensitive system data or modify hardware control configurations. While some assessments categorize this as local, the NVD-provided vector suggests network reachability (AV:N) with high impact on confidentiality and integrity. The vulnerability is addressed in version 4.0.0.
Affected products
- CoolerControl coolercontrold >= 0.14.0, < 4.0.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 4.0.0