CVE-2026-5302

CVE-2026-5302 is a CORS (Cross-Origin Resource Sharing) misconfiguration vulnerability in CoolerControl/coolercontrold versions prior to 4.0.0 that permits unauthenticated remote attackers to read sensitive data and send commands to the affected service through malicious websites. The vulnerability carries a HIGH severity rating with a CVSS score of 8.1, reflecting significant risk to confidentiality and integrity. The attack vector is network-based with low complexity and requires no privileges, though user interaction via a malicious website is necessary for exploitation. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat intelligence hot lists. The EPSS probability of exploitation is extremely low at 0.00033, indicating minimal likelihood of practical attack activity at this time, though organizations running vulnerable versions should apply available patches to version 4.0.0 or later.