CVE-2026-5208
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
Published Apr 8, 2026 · updated Jul 24, 2026 · coolercontrol coolercontrold
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2026 · NIST NVD
Detected
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
Jul 24, 2026 · NIST NVD
Updated
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
Affected
- cpe coolercontrol/coolercontroldversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-5208
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-5208
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
nvd.nist.gov