External risk intelligence

CoolerControl coolercontrold Unauthenticated Data Exposure and Modification via HTTP

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-5300

The vulnerability involves unauthenticated HTTP requests to an API, which could be exposed to the internet. However, coolercontrold is typically used for local hardware or system management, making public internet exposure of this service uncommon in standard deployments.

Missing Authentication

Coolercontrold

before 4.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects CoolerControl's coolercontrold software, allowing unauthenticated access to view and change sensitive data over HTTP. While the technology itself has critical flaws, its typical use case for local hardware management suggests that external exposure to the internet may be uncommon, making the primary concern confirming relevance and potential exposure within your specific environment.

Unauthenticated access to sensitive data.
Potential for unauthorized data viewing and modification.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker can target the CoolerControl service by sending HTTP requests to its API. Because the affected functionality does not require authentication, an attacker can access and alter sensitive data remotely. This could lead to unauthorized data exposure and modification.

No authentication needed for access.
Sensitive data viewed and modified via HTTP.
Risk of data exposure and modification.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could view and alter sensitive data through HTTP requests when the CoolerControl service is accessible via the network. This could impact system or user data, depending on how the service is configured and what information it manages.

System and user data at risk.
Unauthenticated HTTP requests.
Unauthorized data viewing and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CoolerControl's coolercontrold service likely falls under the responsibility of the platform or infrastructure teams managing the underlying systems, with potential collaboration from application owners if the service is integrated into specific applications. The initial step is to identify all instances of coolercontrold, determine their network exposure and business criticality, and then locate the accountable owner for remediation planning.

Platform/Infrastructure teams own the issue.
Verify network exposure and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is coolercontrold?

coolercontrold is the backend daemon component of CoolerControl, a software utility used primarily for monitoring and managing hardware cooling systems. It operates as a service to interface with system sensors and controllers, allowing users to track temperatures and adjust fan speeds or cooling performance directly on their machines.

What does CVE-2026-5300 mean for security?

This vulnerability is classified as CWE-306, which refers to a Missing Authentication for Critical Function. Essentially, the software's interface lacks a security check, meaning it does not verify who is making a request. This allows anyone with network access to the service to bypass login requirements and perform actions that should be restricted to authorized users only.

How can an attacker trigger this vulnerability?

An attacker can trigger the flaw by sending specially crafted HTTP requests directly to the coolercontrold API. This does not require any credentials or prior session establishment. Importantly, this issue is tied to the service's API; it is not triggered by normal, local interaction with the graphical user interface or physical adjustments to hardware settings.

Do I need to worry about CVE-2026-5300?

You should investigate if your systems run coolercontrold versions older than 4.0.0. According to Halo Surface Signal, while the flaw is critical, coolercontrold is typically used for local hardware management and is rarely exposed to the public internet. The main concern is whether your specific network configuration inadvertently makes this internal service accessible to unauthorized remote users.

How do I address this coolercontrold issue?

The first step is to inventory your systems to locate all active instances of the coolercontrold service. Once identified, verify if these services are accessible over your network. Because the vulnerability is addressed in version 4.0.0, you should prioritize updating to this version or higher to implement the necessary authentication controls and close the security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.