What is CVE-2026-5302?

CVE-2026-5302 is a medium-severity vulnerability in Coolercontrol Coolercontrold, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.3/10. Published 2026-04-08.

How severe is CVE-2026-5302?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Coolercontrol Coolercontrold

CVE-2026-5302

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

EPSS: 0.000 (15.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

Affected products

Coolercontrol Coolercontrold — versions 2.0.0

Weakness classification (CWE)

CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

References

gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrold/src/api/mod…
gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0

Frequently asked questions

What is CVE-2026-5302?: CVE-2026-5302 is a medium-severity vulnerability in Coolercontrol Coolercontrold, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.3/10. Published 2026-04-08.
How severe is CVE-2026-5302?: Medium severity. CVSS v3 base score is 6.3 out of 10.