Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

The primary impact of CVE-2026-5302 is the potential for unauthorized data access and command execution. An attacker can leverage a malicious website to craft cross-origin requests targeting the coolercontrold service. Successful exploitation allows the attacker to read sensitive data managed by coolercontrold, potentially including configuration details, operational status, or other critical information. Furthermore, the ability to send commands opens the door to remote control of the system, enabling actions such as altering settings or disrupting operations. The blast radius extends to any system running an affected version of coolercontrold, making it a widespread concern.

Systems running coolercontrold versions 2.0.0 through 4.0.0 are at risk, particularly those exposed to the internet or accessible from untrusted networks. Shared hosting environments where coolercontrold is deployed alongside other applications are also at increased risk, as a compromised application could be used to exploit this vulnerability.

• rust / server:

curl -v -X GET 'http://<coolercontrold_ip>/api/data' -H 'Origin: http://attacker.com'

If the response headers include Access-Control-Allow-Origin: * or Access-Control-Allow-Origin: http://attacker.com, the vulnerability is likely present. • generic web:

curl -I http://<coolercontrold_ip>/api/data -H 'Origin: http://attacker.com'

Inspect the response headers for Access-Control-Allow-Origin.

1. 2026-04-08Disclosure

   disclosure

1. आरक्षित2026-04-01
2. प्रकाशित2026-04-08
3. EPSS अद्यतन2026-04-16

The recommended mitigation for CVE-2026-5302 is to immediately upgrade coolercontrold to version 4.0.0 or later, which contains the fix for the CORS misconfiguration. If upgrading is not immediately feasible, consider implementing temporary workarounds such as configuring a Web Application Firewall (WAF) to block cross-origin requests to the coolercontrold endpoint. Alternatively, you can restrict access to the coolercontrold service by configuring network firewalls to only allow connections from trusted origins. Carefully review and tighten the CORS policy within coolercontrold's configuration to explicitly define allowed origins. After upgrading, confirm the fix by attempting a cross-origin request from a different domain and verifying that it is blocked.