CVE-2026-5208

High

Published: 08 April 2026

Published

08 April 2026

Modified

16 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0036 58.3th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5208 is a high-severity OS Command Injection (CWE-78) vulnerability in Coolercontrol Coolercontrold. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 41.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly prevents command injection by requiring validation of untrusted inputs like alert names to reject malicious bash commands.

SI-2 Flaw Remediation good match

prevent

SI-2 mandates timely remediation of flaws such as this command injection vulnerability through patching to version 4.0.0 or later.

AC-6 Least Privilege partial match

prevent

AC-6 limits the impact of injected code execution by enforcing least privilege, preventing the coolercontrold process from running as root unnecessarily.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Command injection vulnerability (CWE-78) allows arbitrary bash command execution as root (T1059.004: Unix Shell) from a high-privilege context, facilitating privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

Deeper analysisAI

CVE-2026-5208 is a command injection vulnerability (CWE-78) in the alerts component of CoolerControl/coolercontrold versions prior to 4.0.0. It enables attackers to inject bash commands into alert names, leading to arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise with low complexity but requiring local access and high privileges.

An authenticated attacker with high privileges on the affected system can exploit this vulnerability locally by crafting malicious alert names containing injected bash commands. Successful exploitation allows execution of arbitrary code with root privileges, potentially granting full control over the host system, including data exfiltration, persistence, or further lateral movement.

The vulnerability is demonstrated in the source code of version 3.1.0 at alerts.rs line 576 on the project's GitLab repository. Mitigation is available via upgrade to CoolerControl/coolercontrol version 4.0.0 or later, as announced in the corresponding release notes.