What is the CVSS score of CVE-2026-5300?

CVE-2026-5300 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-5300?

Yes, a patch is available for CVE-2026-5300. Update the affected software to the latest version immediately.

Coolercontrold CVE-2026-5300

Q: Which versions of Coolercontrold are affected by CVE-2026-5300?

CoolerControl's coolercontrold daemon versions before 4.0.0 lack proper authentication controls, allowing unauthenticated local attackers to view and modify sensitive system data through unprotected…. A patch is available.

EUVD-2026-20457 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-08 GitLab

GHSA-8gfg-vxcc-9fj7

Authentication Bypass Information Disclosure Coolercontrold Coolercontrol

Critical

Disputed · 9.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

5.9 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 20:22 NVD

MEDIUM CRITICAL

CVSS changed

Jul 24, 2026 - 20:22 NVD

5.9 (MEDIUM) 9.1 (CRITICAL)

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.0

EUVD ID Assigned

Apr 08, 2026 - 13:16 euvd

EUVD-2026-20457

Analysis Generated

Apr 08, 2026 - 13:16 vuln.today

CVE Published

Apr 08, 2026 - 12:04 nvd

MEDIUM 5.9

DescriptionNVD

Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests

AnalysisAI

CoolerControl's coolercontrold daemon versions before 4.0.0 lack proper authentication controls, allowing unauthenticated local attackers to view and modify sensitive system data through unprotected HTTP API endpoints. The vulnerability affects coolercontrold 0.14.0 through 3.x, with CVSS 5.9 reflecting local attack vector and low-complexity exploitation; no public exploit code or active KEV status identified at time of analysis.

Technical ContextAI

CoolerControl's coolercontrold is a system daemon that manages cooling hardware via an HTTP-based REST API. The vulnerability stems from CWE-306 (Missing Authentication Check), where the API router (coolercontrold/src/api/router.rs) implements endpoints without verifying caller identity or authorization. Because the CVSS vector specifies AV:L (local attack vector), the HTTP server likely binds to localhost or a local socket, restricting direct network access but allowing any local process or user to interact with it. The attack surface includes reading system configuration, sensor data, and modifying cooling profiles or hardware settings.

RemediationAI

Upgrade coolercontrold to version 4.0.0 or later immediately. The vendor-released patch is confirmed in version 4.0.0 per the official GitLab release. For users unable to patch immediately, implement local network isolation by restricting access to the coolercontrold HTTP port to trusted processes and users only, and run coolercontrold with minimal necessary privileges to limit the impact of unauthorized modifications to cooling settings. Verify installation via https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0.