What is CVE-2026-5302?

CVE-2026-5302 is a medium-severity vulnerability in Coolercontrol Coolercontrold, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.3/10. Published 2026-04-08.

How severe is CVE-2026-5302?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Coolercontrol Coolercontrold

CVE-2026-5302

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

Published 2026-04-08 · last modified 2026-07-24.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (29.7th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001

Affected products

Coolercontrol Coolercontrold — versions 2.0.0

Weakness classification (CWE)

CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

References

gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrold/src/api/mod… (Exploit)
gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0 (Release Notes)

Frequently asked questions

What is CVE-2026-5302?: CVE-2026-5302 is a medium-severity vulnerability in Coolercontrol Coolercontrold, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.3/10. Published 2026-04-08.
How severe is CVE-2026-5302?: Medium severity. CVSS v3 base score is 6.3 out of 10.