Cyber Posture

CVE-2026-5208

High

Published: 08 April 2026

Published
08 April 2026
Modified
16 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0037 58.9th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 directly prevents command injection by requiring validation of untrusted inputs like alert names to reject malicious bash commands.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely remediation of flaws such as this command injection vulnerability through patching to version 4.0.0 or later.

AC-6 Least Privilege partial match
prevent

AC-6 limits the impact of injected code execution by enforcing least privilege, preventing the coolercontrold process from running as root unnecessarily.

Security SummaryAI

CVE-2026-5208 is a command injection vulnerability (CWE-78) in the alerts component of CoolerControl/coolercontrold versions prior to 4.0.0. It enables attackers to inject bash commands into alert names, leading to arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise with low complexity but requiring local access and high privileges.

An authenticated attacker with high privileges on the affected system can exploit this vulnerability locally by crafting malicious alert names containing injected bash commands. Successful exploitation allows execution of arbitrary code with root privileges, potentially granting full control over the host system, including data exfiltration, persistence, or further lateral movement.

The vulnerability is demonstrated in the source code of version 3.1.0 at alerts.rs line 576 on the project's GitLab repository. Mitigation is available via upgrade to CoolerControl/coolercontrol version 4.0.0 or later, as announced in the corresponding release notes.

Details

CWE(s)
CWE-78

Affected Products

coolercontrol
coolercontrold
3.1.0 — 4.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection vulnerability (CWE-78) allows arbitrary bash command execution as root (T1059.004: Unix Shell) from a high-privilege context, facilitating privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References