CVE-2026-5300 is a missing authentication flaw (CWE-306) in the CoolerControl daemon, coolercontrold, before version 4.0.0. Unauthenticated HTTP requests can view and change potentially sensitive data on the machine. NVD scores it 5.9 medium. The fix is in the 4.0.0 release, so upgrade to that version or later.
What's affected
CoolerControl coolercontrold before version 4.0.0, per the CVE record. The 4.0.0 release is the first named in the project's release page.
CoolerControl manages cooling devices on Linux machines. The daemon serves an HTTP API, and the record says that API worked without authentication in earlier versions.
The scoring uses a local attack vector, so the main concern is other users and processes on the same machine, or a setup that exposes the daemon beyond localhost.
How to check if you're exposed
Read the installed version through your package manager or from the application's about page, for example:
coolercontrold --version
If it is below 4.0.0, upgrade. Also check what address the daemon listens on, using ss -tlnp | grep coolercontrold. A listener on all interfaces instead of localhost widens the exposure.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Update CoolerControl to 4.0.0 or later through your package source.
- Confirm the daemon listens on localhost only unless you intend otherwise.
- Restrict access to the daemon port with the host firewall.
- Review the settings the API manages, such as device profiles, for unexpected changes.
- On shared machines, treat other local users as able to reach the API until you update.
Why it matters
Missing authentication (CWE-306) means a function that should check who is asking does not. Here the daemon's HTTP routes accepted requests from anyone who could reach them, so reading and changing settings needed no credentials.
The impact is limited by what the daemon controls, which is hardware settings like fan speeds, and by the local attack vector in the scoring. That explains the medium score. The record does not report exploitation and it is not in the CISA KEV catalog.
Quick check
Why is the score only 5.9?
The record uses a local attack vector and limited impact on confidentiality, integrity and availability.
Is a firewall enough?
It helps. The proper fix is to upgrade to 4.0.0 or later.
Sources
Last reviewed: 19 October 2026.
