CVE-2026-5208: CoolerControl Command Injection RCE Flaw

CVE-2026-5208 Overview

CVE-2026-5208 is a command injection vulnerability in the alert functionality of CoolerControl/coolercontrold versions prior to 4.0.0. This vulnerability allows authenticated attackers to execute arbitrary code as root by injecting bash commands into alert names. CoolerControl is a cooling device control application commonly used for managing system fans and thermal profiles on Linux systems.

Critical Impact

Authenticated attackers can achieve root-level arbitrary code execution through malicious alert name injection, potentially leading to complete system compromise.

Affected Products

• CoolerControl/coolercontrold versions prior to 4.0.0

Discovery Timeline

• April 8, 2026 - CVE-2026-5208 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5208

Vulnerability Analysis

This command injection vulnerability (CWE-78) exists in the alerts subsystem of CoolerControl's daemon component (coolercontrold). The vulnerability stems from improper handling of user-supplied input in alert name fields, which are subsequently passed to a shell for execution without adequate sanitization.

When an authenticated user creates or modifies an alert, the alert name is incorporated into shell commands executed by the daemon process. Since coolercontrold typically runs with elevated (root) privileges to manage hardware cooling devices, successful exploitation allows attackers to execute arbitrary commands with root privileges.

The vulnerability requires local access and high privileges for initial authentication, but successful exploitation results in a scope change allowing the attacker to impact resources beyond the vulnerable component's security scope. This includes full compromise of confidentiality, integrity, and availability of the target system.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the alert processing code located in the alerts.rs source file. Specifically, the code at line 576 of the alerts.rs file fails to properly escape or sanitize alert names before they are passed to shell execution contexts.

When alert notifications are triggered, the alert name is interpolated directly into shell commands, allowing bash metacharacters and command substitution sequences to be interpreted by the shell.

Attack Vector

The attack vector is local, requiring an authenticated attacker with access to the CoolerControl interface. The attacker creates an alert with a specially crafted name containing bash command injection payloads. When the alert is triggered (based on temperature thresholds or other conditions), the injected commands execute with root privileges.

Example attack scenarios include creating alert names containing command substitution syntax such as backticks or $(command) sequences, semicolons to chain commands, or pipe operators to redirect output to malicious processes.

Detection Methods for CVE-2026-5208

Indicators of Compromise

• Alert configurations in CoolerControl containing shell metacharacters such as backticks, $(, ;, |, or &&
• Unexpected child processes spawned by the coolercontrold process
• Unusual system modifications or new user accounts created while coolercontrold is running
• Log entries showing alert names with suspicious command-like syntax

Detection Strategies

• Monitor coolercontrold process for unexpected child process spawning or unusual system calls
• Implement file integrity monitoring on CoolerControl configuration files
• Use endpoint detection and response (EDR) solutions to identify command injection patterns in process arguments
• Review audit logs for privilege escalation attempts originating from the coolercontrold process

Monitoring Recommendations

• Enable detailed logging for the CoolerControl daemon and alert system
• Configure alerts for any shell command execution by the coolercontrold process
• Monitor for modifications to CoolerControl alert configurations
• Implement process behavior analysis to detect anomalous activity from system daemons

How to Mitigate CVE-2026-5208

Immediate Actions Required

• Upgrade CoolerControl to version 4.0.0 or later immediately
• Audit existing alert configurations for any suspicious or malicious alert names
• Restrict access to the CoolerControl interface to trusted administrators only
• Consider temporarily disabling alert functionality until patching is complete

Patch Information

The vulnerability has been addressed in CoolerControl version 4.0.0. Users should upgrade to this version or later to remediate the vulnerability. The fix implements proper input sanitization for alert names before they are used in shell contexts.

Workarounds

• Disable or remove all configured alerts in CoolerControl until the system can be upgraded
• Implement network segmentation to limit access to systems running vulnerable CoolerControl versions
• Run CoolerControl in a containerized environment with restricted capabilities
• Apply principle of least privilege by restricting which users can create or modify alerts

# Verify CoolerControl version
coolercontrol --version

# Check for updates via package manager (example for Arch Linux)
pacman -Syu coolercontrol

# Review current alert configurations for suspicious entries
grep -r "alert" ~/.config/coolercontrol/