CVE-2026-5208

CVE-2026-5208 is a command injection vulnerability in CoolerControl/coolercontrold versions prior to 4.0.0 that allows authenticated attackers to execute arbitrary code as root by injecting malicious bash commands into alert names. The vulnerability affects the alerts functionality of the affected software and requires valid authentication credentials to exploit. This is a high-severity issue with a CVSS score of 7.2, reflecting the ability to achieve complete compromise of system confidentiality, integrity, and availability once authenticated access is obtained. The attack vector is network-based with low complexity, making exploitation straightforward for authorized users. Currently, the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild, indicating a lower immediate threat level despite the high technical severity rating.